hxxp://duck[.]ai | Triage™

Analysis

user interaction
yes
max time kernel
1434s
max time network
1433s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://duck.ai
Sample260802-b6fmlsbm7s

Score

10^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	SystemPropertiesPerformance.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SystemPropertiesPerformance.exe

Badlisted process makes network request 47 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
275	3652	powershell.exe
276	3652	powershell.exe
277	3652	powershell.exe
285	3652	powershell.exe
286	3652	powershell.exe
287	3652	powershell.exe
288	3652	powershell.exe
289	3652	powershell.exe
290	3652	powershell.exe
291	3652	powershell.exe
292	3652	powershell.exe
293	3652	powershell.exe
294	3652	powershell.exe
319	3652	powershell.exe
320	3652	powershell.exe
326	6784	powershell.exe
327	6784	powershell.exe
328	6784	powershell.exe
329	6784	powershell.exe
330	6784	powershell.exe
331	6784	powershell.exe
333	6784	powershell.exe
334	6784	powershell.exe
335	6784	powershell.exe
336	6784	powershell.exe
337	6784	powershell.exe
338	6784	powershell.exe
339	6784	powershell.exe
351	6784	powershell.exe
352	6784	powershell.exe
353	6784	powershell.exe
354	6784	powershell.exe
355	6784	powershell.exe
363	6784	powershell.exe
365	6784	powershell.exe
366	6784	powershell.exe
367	6784	powershell.exe
368	6784	powershell.exe
371	6784	powershell.exe
374	6784	powershell.exe
375	6784	powershell.exe
376	6784	powershell.exe
377	6784	powershell.exe
378	6784	powershell.exe
386	6784	powershell.exe
387	6784	powershell.exe
388	6784	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 28 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	integrator.exe

Manipulates Digital Signatures 1 TTPs 13 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLVERIFYINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\FINALPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\DIAGNOSTICPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLREMOVESIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTIFICATE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 14 IoCs

pid	Process
4448	MSIC686.tmp
1728	FullTrustNotifier.exe
2100	ose.exe
4480	ose00000.exe
748	dismhost.exe
6180	dismhost.exe
5804	uninstaller.exe
1900	Un_A.exe
6524	firefox.exe
6300	firefox.exe
5308	default-browser-agent.exe
6504	firefox.exe
6768	firefox.exe
4920	Un_B.exe

Loads dropped DLL 64 IoCs

pid	Process
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
384	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
384	MsiExec.exe
4520	MsiExec.exe
6608	MsiExec.exe
4520	MsiExec.exe
6608	MsiExec.exe
4520	MsiExec.exe
4520	MsiExec.exe
6608	MsiExec.exe
6608	MsiExec.exe
6608	MsiExec.exe
3124	MsiExec.exe
748	dismhost.exe
748	dismhost.exe
748	dismhost.exe
748	dismhost.exe
6180	dismhost.exe
6180	dismhost.exe
748	dismhost.exe
748	dismhost.exe
748	dismhost.exe
6180	dismhost.exe
748	dismhost.exe
748	dismhost.exe
748	dismhost.exe
748	dismhost.exe
748	dismhost.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
992	icacls.exe
672	icacls.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall 18.151.0729.0013 = "C:\\Windows\\system32\\cmd.exe /q /c rmdir /s /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
72	raw.githubusercontent.com
320	raw.githubusercontent.com

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	OneDriveSetup.exe

Enumerates connected drives 3 TTPs 32 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	cleanmgr.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe

Indicator Removal: Clear Persistence 1 TTPs 60 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\MitigationOptions	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\MitigationOptions	MsiExec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\MitigationOptions	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\DisableExceptionChainValidation	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\DisableExceptionChainValidation	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe\MitigationOptions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe\MitigationOptions	integrator.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe\MitigationOptions	integrator.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe

Power Settings 1 TTPs 5 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5396	powercfg.exe
5736	rundll32.exe
2748	rundll32.exe
4028	powercfg.exe
6240	powercfg.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setuperr.log	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagwrn.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setupact.log	cleanmgr.exe
File opened for modification	C:\Windows\system32\services.msc	mmc.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log	addinutil.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagerr.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	integrator.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\main-selector.css	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\PlayStore_icon.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Added.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-cn\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_filetype_psd.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress-indeterminate.gif	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\en_US.aff	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_invite_24.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	Un_A.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log.moz-delete	Un_B.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\plugin.js	MsiExec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2RINTL.en-us.dll	OfficeClickToRun.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.WinGet.Client\1.29.280\net48\SharedDependencies\Semver.dll	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.WinGet.Client\1.29.280\net8.0-windows10.0.26100.0\SharedDependencies\x64\Microsoft.Management.Deployment.winmd	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\desktop_acrobat_logo.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js	MsiExec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF672307AB5D642FF8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearm.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_asym.dll	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\SystemTemp\28484639-f28d-4082-97fd-42640270e056.tmp	setup.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AiodLite.dll	msiexec.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe	powershell.exe
File opened for modification	C:\Windows\Installer\MSIC56A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\IA32.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ViewerPS.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\S5AVG9COYE\Microsoft.Vbe.Interop.Forms.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol54.dat	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\assembly\temp\GABJXTJ45M\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\BULNPH76MR\Microsoft.Office.Tools.Word.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\a3dutils.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1433281151\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1827638496\extraction.js	msedge.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	msiexec.exe
File created	C:\Windows\assembly\pubpol45.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\2J505RLJFZ\Policy.12.0.Microsoft.Office.Interop.Outlook.config	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSIBA80.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\comments.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CORPCHAR.TXT2	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\ME6H271NHZ\Microsoft.Office.Tools.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_837922931\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\~DF58B947C2D22930EF.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\temp\E21FL2CEWB\Policy.12.0.Microsoft.Office.Interop.SmartTag.config	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol60.dat	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\3U8AEY2JM0\Policy.12.0.office.config	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\M8LIUSYBRO\Policy.14.0.Microsoft.Office.Interop.Access.Dao.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1162018605\manifest.json	msedge.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\temp\B9EQGGTQ6Y\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6064	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileSyncConfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un_B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIC686.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3464	chrome.exe
3416	msedge.exe
2276	msedge.exe
2480	msedge.exe
2656	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Checks processor information in registry 2 TTPs 47 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	integrator.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	integrator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4120	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3784	taskkill.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Colors	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Colors	firefox.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions	integrator.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.8 = 726f61646361737450657273697374656e7453746174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e745374617465496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e74537461746552657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655265747279496e6e65724c6f6f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f61646361737465725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c22536861726564436f6d6d656e74735f447261667443617264556e6d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224544502a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e44796e616d696343616e766173222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224f7574537061636543616e7661735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2250726f677265737355695c22203a207b205c224576656e74735c22203a207b205c22556e6578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2243616e7661735c22203a207b205c225375624e616d657370616365735c22203a207b205c225765624469616c6f675c22203a207b205c225375624e616d657370616365735c22203a207b205c2242726f777365724576656e7448616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4c6f616465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224e617669676174696f6e48616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4e61766967617465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e457863656c222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f617574685c22203a207b205c224576656e74735c22203a207b205c224f70656e46696c655c22203a207b205c224576656e74466c61675c22203a203330393632323437343338323231303536207d2c205c22457865637574654d65726765496e7374616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224b69636b4f6666517569636b536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22586c53796e6353746174654368616e67654c697374656e65724f6e53796e6353746174654368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f63734765744f70496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f7365576f726b626f6f6b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224261636b67726f756e6451756575655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e526573706f6e736552656365697665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f70464275696c644765745265766973696f6e526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536b697070656443686743656c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243717532674872446f456e74657243656c6c466d6c61584c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203330393632323437343338323231303536207d207d207d2c205c22496e6672615c22203a207b205c224576656e74735c22203a207b205c224164644c6f63616c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6d6d616e645c22203a207b205c224576656e74735c22203a207b205c2252656672657368416c6c5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22526566457874446174615c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2243616c635c22203a207b205c224576656e74735c22203a207b205c224669784d616e75616c43616c634f6e4c6f61645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4578706572696d656e746174696f6e222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224564676546657463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164696e67466972737453657373696f6e43616368655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744665617475726573466f72534458556e65787065637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224142436f6e66696754726561746d656e7454797065556e65787065637465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e457874656e736962696c697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224f66666963654a735c22203a207b205c224576656e74735c22203a207b205c22417070436f6d6d616e64446566696e6974696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225363726970744c6f6164585c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436174616c6f675c22203a207b205c224576656e74735c22203a207b205c2245786368616e67654765744c617374557064617465325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22547279446973636f76657245777355726c735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e67654765744c6173745570646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254727948616e646c6541757468656e7469636174696f6e526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e6765476574456e7469746c656d656e74735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786368616e67654765744d616e6966657374735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786368616e676552656672657368457874656e73696f6e4c6973745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241757468656e7469636174696f6e526963684170695c22203a207b205c224576656e74735c22203a207b205c22476574416363657373546f6b656e56324261636b67726f756e645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574416363657373546f6b656e56324d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574416363657373546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22496e7374616c6c65725c22203a207b205c225375624e616d657370616365735c22203a207b205c225461736b456e67696e655c22203a207b205c224576656e74735c22203a207b205c224765744368616e676564536f6c7574696f6e735461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224765744368616e676564536f6c7574696f6e735461736b5265676973746572536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b52656769737465724e65757472616c5061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b5363686564756c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b526567697374726174696f6e4572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b537563636573735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b496e46696e616c697a655374617465457863657074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b536574496e7374616c6c5374617475734572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b61676541707078457874726163746f725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b6167655265717565737465725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b6167655265717565737465725461736b53657276696365526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b446573747275637465644265666f7265436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b436f6d706c6574656446657463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b496e7374616c6c6564417070735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b4170704665746368446f6e655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b61676553617665725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578705061636b616765526567697374726174696f6e496e666f5461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b616765536f6c7574696f6e49445570646174655461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578747261637446696c6573546573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245787472616374466f6f747072696e7446696c6573546573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b52756e4e657874457863657074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f73664d616e696665737456616c696461746f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744368616e676564536f6c7574696f6e735461736b52656769737465724c6f63616c655061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c476574436f6e66696755726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253636176656e6765725461736b436c656172526567697374726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b5265676973746572536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b52656769737465724e65757472616c5061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b52656769737465724c6f63616c655061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b4c6f63616c65556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b5061636b616765556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253636176656e6765725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253636176656e6765725461736b436c656172526567697374726174696f6e4661696c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d61696e5c22203a207b205c224576656e74735c22203a207b205c225344584261636b67726f756e645461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c65725374617274436f6d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c657253746172744e6f74434f4d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c657253746172744d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c5363686564756c655461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c53687574646f776e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744e6574776f726b436f737454696d656f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744e6574776f726b436f737453657276696365556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c225061636b61676541707078457874726163746f725461736b5061636b616765496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253616e64626f785c22203a207b205c224576656e74735c22203a207b205c22506f73744f7366436f6e74726f6c4d6573736167655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f445041637469766174696f6e48616e67696e675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253616e64626f784372656174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654f7366436f6e74726f6c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225365744f4d546f6b656e4f6e54726964656e74486f73745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657454	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\VersionId = "uint16_t\|0"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor\ULSTagIds0 = "18679566,5804129,7202269,23978014,39965824,7692557,5850525,34198423,41484365,17962391,17962392"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile\MsaDevice = "t=GwDmAbuEBAAUuXgePZcYxdw8EZuBoUxTAR3gtGcOZgAAECCJ3JC9TrayDQxemEYGTGSwAUu9vNzbapYP6YY113g1ynXBD4/TloBpzXtA9GlH343FlMAdP7C0TJa7yRHuSpkAZHjBQtpLT4dcm+FDC38dJ/BfSDDkjqTcSALDH3g01fTUmcH1Sv0Ux0M8b2OfHrxQV26gqLNBRkYew020uKL7537CkgQWfmKH23BDhrR24A5e4u52TJC4JSIVZS13N402PNW022/MudHkU/sPZG6cAXJVWUX89LK6l0B2Ji0+xr44qCc6vR4dC9iOFyiGv7LxxYlDATEZYmgY/+mac+bpz+YQWHsUixAHpdxIbkgi2Sn33sAiu+2R9bYu9ybNbVtUiuEeHpRJLHp7C9zkQ3qQeVBm9kEAlwZBLD3Bz2NWUfxCspCyvnFjcAAASwFlm3T/4/b6a1u+s58Qt1MF++ehxy6hZFfF97ERDt7A/7DVxBBWvCqpo07aZq28PvEYeRPIWOgaACPrEQ9vykOGWEid0s4aA8x9I5LqEIcnR59xxRRw0oyQkx5m8de89GZzkr96F2dJ4urz7CEXG6C5SQEzEznBLaQ8gh/wAY4XObbYjYO1QL1X3znbQRSkCatmKvhzUfYB&p="	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.4 = 6f736f66742e4f66666963652e5365676d656e746174696f6e2e46617374465445222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e46726f6e7469657241756469656e6365222c20225622203a20227374643a3a77737472696e677c4e6f6e6522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4d53495442697a63686174416c6c6f776c697374222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4d6f636861222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4f584f416c6c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e50657270657475616c4c6963656e7365222c20225622203a20227374643a3a77737472696e677c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e5365676d656e74222c20225622203a20227374643a3a77737472696e677c4e4f4e4652444322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e56657273696f6e506172746974696f6e222c20225622203a20227374643a3a77737472696e677c57696e3332416e64726f6964486f7422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e576f7264436f70696c6f74446f67666f6f64222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e416c6c6f775a65726f4c656e677468536561726368537472696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f436f727265637455492e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f446973636f7665722e4275674669786573466f7252657472794661696c65645265717565737473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f446973636f7665722e4c696d6974546f4f6e654175746f446973636f766572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f446973636f7665722e4f6e6c795573654874747073222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e426f6f7449646c655468726f74746c6572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4275674669782e506572736f6e61436f6e74726f6c4261636b67726f756e64436f6c6f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4368616e6765476174652e44656c617943757272656e745549416374697665506c616365557064617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4372634261736564556964222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e43726974697175652e44697361626c65644c616e677561676573222c20225622203a20227374643a3a77737472696e677c6a612c7a6822207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e43726974697175652e4c6f67496e7465726e616c4e616d65416e645072696f72697479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e456469746f72536572766963652e557365496e737472756d656e746174696f6e417069222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744865647769675558222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f7274496e73657274416c6c4f626a6563747356696577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e47726170686963732e4368616e6765476174652e5570646174655461626c65426f756e6473466f72547970696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4967782e456e7375726545326f4d6f6e696b65724166746572456e7375726545326f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4e6577456e737572655549444c6f676963222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4f6666696365496e736964657243757272656e74526567697374726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4f6666696365496e7369646572526567697374726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e416c6c6f7746696e6450656f706c655573616765496e41744d656e74696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e4175746f436f6d706c6574652e46696e6450656f706c65537570706f7274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e4669784e6f6e526566436f756e7465644d736f506572736f6e6173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e4261636b67726f756e64576f726b436f6e74726f6c6c6572427567466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e427567466978466f7241744d656e74696f6e734d6f6e69746f72696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e427567466978466f7250686f746f41637469766974794c6f6767696e6752656d6f76616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e436f6e746163744361726456324f766572666c6f774d656e7573506861736532222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e46696e6450656f706c655573616765456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e497350656f706c655365617263684578656375746f72456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e506378417072696c323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784665627275617279323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784a616e75617279323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784a756e65323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784d61726368323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e557365506378436f6e74616374496e666f4c697374222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378417072696c323031374275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6d6d6f6e436f6d70617265427567466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6e746163744361726444706941776172656e6573734275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6e7461637443617264466f6e74486569676874444450494275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784a756e65323031374275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784d61726368323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784f63746f626572323031364275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e436f6e7461637453656172636849676e6f72657353796d626f6c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e50637848616e646c65734175746f446973636f766572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e526563697069656e744175746f436f6d706c657465537570706f7274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50726f6f66696e672e4175746f4d616e616765722e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e536d6172744c696e6b732e416c6c6f775265636f676e697a65536d6172744c696e6b73496e7369646550617261677261706873222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e54686573617572757350616e652e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5472616e736c61746f722e456e61626c65466c6f6f6467617465537572766579222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5472616e736c61746f722e466c6f6f646761746553757276657944656c6179222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e46574153686f756c64426c6f636b53656c4368616e67656446616c73654576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e57726974696e67417373697374616e63654372697469717565466f724347415049222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e57726974696e67417373697374616e636555492e50616e652e46697857726f6e67436c6f73654c6f676963222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e436f6c6f72466f6e74537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e46696c6556657273696f6e696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e48696464656e466f6e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e4f4172745465787456616c696461746552616e6765564544222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e416c6c6f774475706c696361746555696d557064617465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e436f7079506173746548544d4c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5472616e7363726962652e436f6e666967436865636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e417269614d617854656172646f776e55706c6f616454696d65496e536563222c20225622203a2022696e7433325f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e566f6c756d65547261636b696e674d61784576656e7473222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4169725370616365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224261636b656e645c22203a207b205c224576656e74735c22203a207b205c224c61796572486f7374496e697469616c697a6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706f7369746f7253657373696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2257696e33325c22203a207b205c225375624e616d657370616365735c22203a207b205c224c65676163795c22203a207b205c224576656e74735c22203a207b205c22416e696d6174696f6e50657263656e74556e64657233304650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416e696d6174696f6e4176674650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726f737357696e54496d654f6646697273744672616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224176657261676550726573656e74735065725365636f6e645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4368617274696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436861727445326f4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436861727445326f536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617274696e67456e644c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e436c69636b546f52756e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225850445c22203a207b205c225375624e616d657370616365735c22203a207b205c2254656c656d657472795c22203a207b205c224576656e74735c22203a207b205c2253616d706c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c225570646174655461736b557064617465646574656374696f6e325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465636c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b46756c6c7265706169725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b52656d6f7665696e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c20	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1"	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	integrator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.3 = 20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e43472e4973557365436f6e6669674175746848616e646c6572466f724e6f6e506f70456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4368616e6765476174652e4f6e6c7950657273697374536368656d65466f7253657276657255726c73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e456e61626c6557616d54656c656d65747279426c6f62222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e456e7375726550726f66696c65466f725072696d6172794964656e746974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e49676e6f726544697361626c654144414c61746f7057414d4f76657272696465466f725075726557414d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e53706f41757468436f6e74657874456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e5573654964656e7469747943726564656e7469616c734661696c757265496e666f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e55736553706f436f6f6b696546726f6d53616d6554656e616e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e44617465546f5573654d6963726f736f6674333635466f72436f6e73756d657273222c20225622203a20227374643a3a77737472696e677c323032302d30342d32315430303a30303a30302e302b30303a303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e44617465546f5573654d6963726f736f6674333635466f72534d42222c20225622203a20227374643a3a77737472696e677c323032302d30342d32315430303a30303a30302e302b30303a303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e456e61626c6547726163655769746857414350726f6d6f427573426172222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e456e61626c654d6f6465726e41464f222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e486561727462656174446179734265666f726545787044617465222c20225622203a2022696e7433325f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e4e6f456e7469746c656d656e747353656c6653657276696365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e4e6f456e7469746c656d656e74735472794275794578706572696d656e7454726561746d656e74222c20225622203a2022696e7433325f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e53686f77564e6578745369676e4f75744469616c6f67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573655265666163746f726564436f6e666967446570726f766973696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4c6963656e73696e672e5573655265666163746f726564476574557365724c6963656e7365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e436c6f7564506f6c6963792e4e6f6e5075626c6963436c6f7564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e54656e616e744173736f63696174696f6e4b65792e4e6f6e5075626c6963436c6f7564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4d616e6167656162696c6974792e5573654f637073563255726c496e57696e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e43475f4d6f73506f70756c617465436f6e74656e74456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e496e766f6b6546657463684d616e696665737443616c6c6261636b4f6e446f776e6c6f61644d616e6966657374222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e506f6c697368466c796f757453656172636854656c656d65747279222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e557365436c6f6e6564496e7374616e6365466f724572726f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4368616e6765476174652e56616c6964617465446f776e6c6f61645265736f7572636573222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4469616c6f6754776f5761794d6573736167696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e456e61626c654d696e43616368655265667265736820222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4964656e746974794361636865466f72636552656672657368222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e4f7366496e7374616c6c6572526567697374657242675461736b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e506572557365724964656e746974794d696e4361636865222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e506572557365724964656e74697479526962626f6e4361636865222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f45502e5765624b69743246756c6c4469616c6f67415049222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e456e61626c65456e7465727072697365436f6d416464696e536574436f6e6e656374496e7465726e616c5570646174654576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e456e61626c65456e7465727072697365436f6d416464696e556e68616e646c6564457863657074696f6e4576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f4d45582e4572666d4c6f67446179436f756e74456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6172742e456e61626c65416972537061636547726f757044726167466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6172742e456e61626c65496e736572744d6564696154656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e4170706c652e43576f726b73706163655573657255736555726c46726f6d526177556e69636f6465537472696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e4170706c7944656661756c744c6162656c4f6e53656374696f6e4e617669676174696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e4368616e6765476174652e53686f77494150456e747279222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e44656570426174636853746f7265456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e52656e6465725570646174656457696e333252656458222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f6e654e6f74652e53686f756c645573654e6574436f7374496e73746561644f664d736f426c6f636b696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e4c6173744d696c6554656c656d6574727954726163657274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e5063782e4c696e6b6564496e4b32466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e5063782e5063784a756e65323031394275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e526970636f72642e33363134383230222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e526970636f72642e33393039323635222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4f75746c6f6f6b2e526970636f72642e33393435323833222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5043582e526970636f72642e56534f2e33363432383036222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e426c6f636b696e6757616974732e4f737250726f63657373222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572666f726d616e63652e4368616e6765476174652e586c426f6f74436f6d706c657465416674657246696c654f70656e416e6453706c61736853637265656e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c65476574496e736967687473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e456e61626c6553656e645369676e616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506572736f6e616c697a6174696f6e2e557365476574496e736967687473466c6f77466f724665746368696e67476f7665726e616e636544617461222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4175676c6f6f702e436f6d70726568656e73696f6e53756d6d6172792e456e61626c654465666572726564526169222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e436865636b56696577496e536c6964654a616e69746f724f62736572766572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e466f726365536f6674776172654d696e69617475726552656e646572696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e4d657267652e5573655468726f77696e674c69666567756172645374657073222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e4368616e6765476174652e536c69646553686f772e52656c65617365536c69646553686f774d616e616765724265666f726547667853687574646f776e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e48616e646c65434c524372617368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e53756767657374696f6e732e456e61626c65436f6e74656e745265636f6d6d656e646174696f6e4974656d73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e456e61626c654167656e74456e74727947617465536f7665726569676e436c6f7564436865636b222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e742e66613030303030303132392e456e61626c65466f7263655070744167656e74496e5075626c6963436c6f7564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e506f776572506f696e744f6e6c696e652e4175676c6f6f702e436f70696c6f742e5354466978656450726573466f724e6f546f706963466f72416c6c54656d706c61746573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e50726f6a6563742e50726f6a65637443325253657276657232303133436f6e6e656374696f6e426c6f636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e50726f6a6563742e50726f6a65637443656e74656e6e69616c53657276657232303133426c6f636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e50726f6a6563742e50726f6a65637443656e74656e6e69616c53657276657232303133436f6e6e656374696f6e426c6f636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e434c502e5570646174655374617475734261724f6e50726f66696c65537769746368222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e43656e7472616c697a6564457874656e73696f6e536166657479436865636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e49524d2e5758505644697361626c654c6f616454656d706c617465734f6e426f6f74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e4973457874656e73696f6e496e4c697374557064617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e4d6f6e69746f72656446696c65457874656e73696f6e4c697374222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e50726f74656374696f6e536572766963652e4e657755784d6f64656c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e53686f756c6452756e436c6f75645365637572697479506f6c696379436865636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e53656375726974792e5573654e6f526566436f756e74416d736953747265616d222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e436c6f7564222c20225622203a20227374643a3a77737472696e677c5075626c696322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e436f6d6d65726369616c54656e616e7447726f7570222c20225622203a20227374643a3a77737472696e677c556e6b6e6f776e22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e436f70696c6f7446726f6e74696572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e436f70696c6f7446726f6e746965722d53746167696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e436f70696c6f7453616e64626f78222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d696372	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018401774E2FC28 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000841065acb815f64bbeb98b155795fd2000000000020000000000106600000001000020000000d7f57c665d646ffac01636b657312b0a43d88f5479759843a3366ab00d8c83da000000000e8000000002000020000000d9ce21a9015a79aeb7de495d24c0d8884e4cb8c86b4f36796fdecaef0f58f1f880000000ff7483806e1811a29b1f1b411375cd8adae54440cebdb7ac00aadb75d47309941e8b7229c61c22e2718eb2a9f0f24a82cdc8b5a199c48cfe4aea7dff6d016f5c05a913f020eae1d8a3afbffe2ba70043c0c5fa38a58655111d3a298738d7eca733b6501faaa2148850cea4a9c3408aed8948452ca10817026ffe3d08bf149c9e4000000095d3bdc5453953da461a3376dc1a144c5452d0d25f4215b366756b4ec209f4f25faf61a33ecfff8253faed274cea159e74d43326c91e377650a0a8cfbe5a725b	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|9"	integrator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.12 = 496e666f46696c65416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6162656c696e67457870657269656e63655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224164644c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656d6f76654c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6163726f5c22203a207b205c224576656e74735c22203a207b205c22426c6f636b4d6163726f46726f6d496e7465726e6574506f6c69637953657474696e675c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22426c6f636b6564657874656e73696f6e735c22203a207b205c224576656e74735c22203a207b205c2246696c65457874656e73696f6e4c69737446726f6d536572766963655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22536563757265526561646572486f73745c22203a207b205c224576656e74735c22203a207b205c224f70656e496e4f53525c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54617267657465644d6573736167696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224275736261725468656d6553656c656374696f6e5374617475735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54656c656d65747279222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436c69656e7453616d706c696e674f76657272696464656e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253797374656d4865616c74684d657461646174614e6574776f726b436f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224576656e7451756172616e74696e65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164586d6c52756c65735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737349646c6551756575654a6f625c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22466c7573684576656e744275666665725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2254656c656d6574727953656e74696e656c56616c75655c22203a207b205c224576656e74466c61675c22203a2030207d207d2c205c224c6f636b65645c22203a2066616c7365207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54656c6c4d65222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2254656c6c4d655741435c22203a207b205c224576656e74735c22203a207b205c225175657279526573706f6e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54657874222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225265736f75726365436c69656e745c22203a207b205c224576656e74735c22203a207b205c22446573657269616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656164466f6e74456c656d656e74735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2250757267654d756c7469706c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561645265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2257726974655265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22474449417373697374616e745c22203a207b205c224576656e74735c22203a207b205c225265676973746572436c6f7564466f6e7443616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2248616e646c6543616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22466f6e744d616e6167657244657374727563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464436c6f7564466f6e745265736f757263655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466f6e74537562737469747574696f6e5c22203a207b205c224576656e74735c22203a207b205c22436f6c6c656374466f6e74537562737469747574696f6e55736167655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5472616e736c61746f72222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22416c7465726e6174655472616e736c6174696f6e735265747269657665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6e7465787475616c53756767657374696f6e734c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745465787453656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c61746564466565646261636b547269676765725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c6174696f6e43616e63656c6c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c6174696f6e53756767657374696f6e436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578636c756465644c616e677561676541646465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578636c756465644c616e677561676552656d6f7665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d6963726f666565646261636b566f746553656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6f786d6c5472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657474696e6773436c6f7365645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657474696e67734f70656e65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365446f63756d656e744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365546172676574537761707065645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365546578744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546172676574446f63756d656e744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546172676574546578744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546578745472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e496e7365727465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e4c616e6775616765734c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e5461624368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e4578616d706c655265747269657665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e436f706965645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464496e4c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5558222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22526962626f6e585c22203a207b205c224576656e74735c22203a207b205c225265707572706f736564436f6d6d616e6445786563757465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225344585c22203a207b205c225375624e616d657370616365735c22203a207b205c224d65436f6e74726f6c5c22203a207b205c224576656e74735c22203a207b205c22547261636b65645363656e6172696f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225465616368696e6743616c6c6f75745c22203a207b205c224576656e74735c22203a207b205c225465616368696e6743616c6c6f7574416c726561647953686f776e4d617854696d65735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574416c726561647953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574546f6f4d616e7953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2244796e616d69634470695c22203a207b205c224576656e74735c22203a207b205c22446973706c6179546f706f6c6f6779456e756d65726174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446973706c6179546f706f6c6f67794368616e6765645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22446f63756d656e745265636f766572795c22203a207b205c224576656e74735c22203a207b205c22496e76616c696461746550616e65735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22546f6f6c746970735c22203a207b205c224576656e74735c22203a207b205c2253686f77546f6f6c7469705c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416e63686f7252656769737472795c22203a207b205c224576656e74735c22203a207b205c224765744f72437265617465416e63686f7252656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22526962626f6e546162735c22203a207b205c224576656e74735c22203a207b205c22526962626f6e5461624163746976617465645f466c6f6f64676174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c22436f6c6f725069636b65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d696e67536f6f6e54435348574e445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f46696c65457874656e73696f6e49636f6e4d617070696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e576f7264222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224544505c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e744964656e746974794368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f6f66696e675c22203a207b205c224576656e74735c22203a207b205c2250726f6f66696e674e6f50726f6f66526567696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225453706c4c6f61644c6962726172795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f75645370656c6c6572436865636b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f50726f6f6652756e4469666665727346726f6d5061726150726f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c617373696669636174696f6e4372697469717565526573706f6e7365506572664d61704578636565645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224772616d6d6172436865636b657243616c6c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22536176655c22203a207b205c224576656e74735c22203a207b205c22436d64446f53617665446f63436f7265436f6d6d616e64416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436d64446f53617665446f63436f7265416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464d617953746172745472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224669726553746174654f664175746f536176654f6e436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456964456e737572654f70656e466f72536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2242475361766546616c6c6261636b546f46475c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e646f466369466f72536176654361556e646f436f72655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72645c22203a207b205c225375624e616d657370616365735c22203a207b205c22426f6f745c22203a207b205c225375624e616d657370616365735c22203a207b205c2254696d696e675c22203a207b205c224576656e74735c22203a207b205c22446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22426f6f745c22203a207b205c224576656e74735c22203a207b205c22416464696e4d6f6e69746f7256616c6964617465426f6f745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e44697361626c65644469616c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e4d6f6e69746f7256616c6964617465426f6f74325c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c654f70656e5c22203a207b205c224576656e74735c22203a207b205c22464e4d45696453657446726f6d5873747a46747970466e6d4469725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e697469616c697a6542696e6172794261636b696e6753746f72654361636865735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72644d61696c5c22203a207b205c224576656e74735c22203a207b205c2248724c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872536176655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f6354696c696e675c22203a207b205c224576656e74735c22203a207b205c2254696c696e6749646c6542756e646c654576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654669726542756e646c65644576656e74735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577476574456e756d657261746f724576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577446973636f6e6e6563745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b52656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b556e72656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f417574686f72696e675c22203a207b205c224576656e74735c22203a207b205c224f6373446f776e6c6f6164526566557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244796e616d696353617665496e697469616c496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70436f6d706c657465645374617475735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2254687265655761794d657267655c22203a207b205c224576656e74735c22203a207b205c22435254435265766572745265706c61794b706f7353636f70654475726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c22436d645361766546696c65436f7265325c22203a207b205c224576656e74466c61675c22203a2032207d207d	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.2 = 4622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e44796e616d6963467261676d656e7453697a65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e456e61626c65466f726365486f73744d6f6465466f7253796e634261636b6564486f73744f6e4f70656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4661696c43616c6c73546f5472616e73616374656453747265616d446174614265666f72654373694c6f616446696c65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4872446f776e6c6f616454656d704173796e634c4d54222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e496e637265617365644279746573427566666572657257696e646f7753697a65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e496e6372656d656e74616c4f70656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4973496e74656c6c6967656e745361766550726f6d7074537572766579456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e49734f70656e4572726f724469616c6f6741626c65546f42654f76657272696464656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4c6f636174696f6e5069636b65725468726565446f74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4e65766572466f726365486f73744d6f6465496e436f6c6c61625265636f6e63696c6174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4f63735072656665746368496e7465726e616c436f6f7264696e6174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4f637369576f726b696e67436f7079577269746546696c654d61785265747279436f756e74222c20225622203a2022696e7433325f747c3522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4f637369576f726b696e67436f7079577269746546696c655265747279496e74657276616c496e4d696c6c697365636f6e6473222c20225622203a2022696e7433325f747c31303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e50726f746f636f6c48616e646c65722e44697361626c65457863656c53656375726974794469616c6f67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e50726f746f636f6c48616e646c65722e44697361626c65506f776572506f696e7453656375726974794469616c6f67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e50726f746f636f6c48616e646c65722e44697361626c65576f726453656375726974794469616c6f67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5265667265736855706f6e526573746f726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536572766572496e666f4d736f446176436865636b456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536861726555726c456e64706f696e744361636865456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e53686f756c645265717565737451756572794578706563746564416363657373222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536b6970556e636f6d70617261626c65446f776e6c6f61645265766973696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e536b6970576563496e6974447572696e674f70656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e53747269637453746f726167654c6966656379636c65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e537472697056657273696f6e494446726f6d55726c4265666f726553656e64696e67546f437369222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5472696767657253796e63496e7369646548616e646c6542617365446f776e6c6f61644572726f72222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e556e7365745265736f757263654964496646696c655761734e6f745361766564546f536572766572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5573654361636865644e6574776f726b436f6e6e656374696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e5573655265666163746f72656453796e634368616e6e656c496e486f73745265766973696f6e7355706461746572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e557365586d6c48747470436f6d706f6e656e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e56616c69646174654d617050617468734c697465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e44656661756c744368616e6e656c436f6f6c646f776e2e42616e6e6572222c20225622203a2022696e7433325f747c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c6543616d706169676e436c69656e74222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c654d6f6465726e466c6f7757697468546965726564476f7665726e616e6365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c654d756c74694c61756e636853757276657943616d706169676e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c6554656c656d657472794576656e745472616e736475636572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e496e7369646572546f6173744c61756e63686572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e4d617843616d706169676e73506572417070222c20225622203a2022696e7433325f747c323522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e4d6178446961676e6f73746963436f6c6c656374696f6e73506572417070222c20225622203a2022696e7433325f747c323022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e4e6f746669636174696f6e4c61756e63686572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e50726976616379436865636b466f724e6f6e436f6e74726f6c6c657253657276696365466f72537572766579222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e526f616d696e67426173656443616d706169676e537461746573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e526f616d696e674261736564476f7665726e65644368616e6e656c537461746573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e526f616d696e67426173656453757276657941637469766174696f6e5374617473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e466c6f6f64676174652e53757276657973456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e41766f6964556e6e656365737361727944657669636552656372656174654f6e446973706c61794368616e6765222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e436865636b507265666572436d644c697374466f7243616c6c436d64546f7373556e646f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e456e73757265496e6b5374796c65496e69745769746853757266616365222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e4669784465766963655265456e756d65726174696f6e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e52756e4d6f646966794465736372697074696f6e436f6d6d616e6441734d6f6465726e496e457863656c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e5365745465787446696c6c546f426c61636b466f7253656c6563746564486967686c69676874222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e5365745465787446696c6c546f426c61636b466f7253656c6563746564486967686c6967687432222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4368616e6765476174652e5573655368617265644458474941646170746572456e756d65726174696f6e4c6f676963466f7253746172747570222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e436f6d6d616e64732e456e61626c6553657450696374757265417370656374526174696f436d64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e436f6d6d616e64732e456e61626c655365745461626c655374796c65436d64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e44657669636544657374727563746f724432444c6f636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e456e61626c654368616e676550696374757265436f6d6d616e64466f72426c697046696c6c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e456e61626c655356474c696e65416e6446696c6c436f6d6d616e6473466f72536861706573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e47657443616c6c537461636b466f7246576964656e222c20225622203a2022696e7433325f747c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e496e6b2e44656c657465416c6c496e6b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4d617833444d6174657269616c5465787475726553697a65222c20225622203a2022696e7433325f747c3430393622207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4d6f64656c33444f6e6c696e652e426c6f636b6564436f756e7472696573222c20225622203a20227374643a3a77737472696e677c61663b647a3b62683b636e3b63753b65673b69643b69723b69713b6a6f3b6b773b6c623b6c793b6d723b6d613b6b703b6f6d3b71613b73613b73643b73793b746e3b74723b61653b796522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4d6f64656c33444f6e6c696e652e426c6f636b65644c616e677561676573222c20225622203a20227374643a3a77737472696e677c74722d74723b7a682d636e3b61722d73613b69642d696422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e4d756c74695363656e654465707265636174696f6e732e476574554957696e646f7746726f6d55736572496e74657266616365222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e526574727943726561746544324431466163746f72794f6e44656c61794c6f61644661696c7572654d617852657472696573222c20225622203a2022696e7433325f747c323022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e536b69704661696c656446436f70794f50544573496e46436f7079222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e536e61704c696e655769647468496e50656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e53746172744174506172656e7454696d65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e537570706f727454657874496e535647546f5368617065436f6e76657273696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e557365417263546578747572654265666f7265443244222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654c6973744e6f6465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e5573654c6f676963616c445049466f72566563746f72496d6167655265736f75726365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726170686963732e557365536d617274496e6b416e616c797a6572466f72496e6b456469746f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e466f726365456e67696e6553657475704f6e4247546872656164222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e4f7074696d697a65526f616d696e6753657474696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e547275737442617244656c6179466f726d6174222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e47726f7774682e41697254726166666963436f6e74726f6c2e556e666f726d6174746564427573426172222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e48656c702e496e636c756465436f6d6d616e6454797065222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e4144414c5468726f74746c696e67456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4964656e746974792e41766f696453656e64696e675368617265506f696e7448656164657273546f5075626c6963456e64706f696e7473222c20225622203a2022626f6f6c7c3022207d2c207b	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|2"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigIds = "std::wstring\|P-R-1755680-1-1,P-R-1098158-1-5,P-R-76757-1-2,P-R-54903-1-3,P-R-26146-7-17,P-D-29635-1-1,P-D-27087-1-9,P-R-51427-18-12,P-R-1814369-8-4,P-R-38390-18-21,P-R-35099-2-4,P-R-61408-18-3,P-R-55746-2-5,P-R-53512-1-4,P-R-46974-18-18,P-R-38953-1-11,P-R-36551-18-18,P-R-1870492-14-4,P-R-71414-1-6,P-R-40253-6-19,P-R-40254-6-18,P-R-35401-6-7,P-R-32107-22-22,P-R-39146-14-15,P-R-39147-14-20,P-R-28546-6-11,P-R-28165-6-28,P-R-24980-8-48,P-R-24390-5-12,P-R-18279-2-65,P-D-34200-4-5,P-R-51145-2-7,P-R-29928-2-20,P-R-67932-1-4,P-R-67201-1-4,P-R-64545-1-4,P-R-64035-1-4,P-R-53515-18-9,P-R-53280-1-6,P-R-52247-1-5,P-R-51958-1-5,P-R-51842-1-5,P-R-51277-2-6,P-R-47451-18-20,P-R-45919-18-19,P-R-45085-18-12,P-R-41442-18-18,P-R-38085-12-9,P-R-18744-6-22,P-D-34239-1-6,P-R-1034169-10-7,P-E-28677-C1-3,P-R-1880289-4-12,P-R-55122-8-8,P-R-50255-10-9,P-R-44907-1-9,P-R-45314-10-16,P-R-44965-2-6,P-E-38231-2-4,P-R-1895541-14-15,P-R-94560-14-12,P-R-94189-14-13,P-R-93882-14-26,P-R-54728-16-23,P-R-54698-16-16,P-R-54658-18-19,P-R-38306-C17-3,P-R-35717-5-30,P-R-34019-4-3,P-R-1789119-9-2,P-R-1025232-24-9,P-R-71358-1-4,P-R-70941-1-4,P-R-69065-1-3,P-R-67160-1-7,P-R-59781-1-4,P-R-55631-1-4,P-R-54215-1-4,P-R-53751-1-4,P-R-53752-1-4,P-R-53526-1-4,P-R-52110-1-4,P-R-49765-15-32,P-R-48818-17-25,P-R-50679-1-4,P-R-50486-18-12,P-R-44830-18-13,P-R-49416-4-14,P-R-48457-2-6,P-R-47974-16-18,P-R-46544-18-11,P-R-45609-14-6,P-R-45197-2-6,P-R-44046-18-11,P-R-44015-18-20,P-R-43723-2-6,P-R-41742-18-32,P-R-40980-18-16,P-R-40359-2-10,P-R-39029-5-18,P-R-38835-18-48,P-R-37676-18-46,P-R-36310-4-5,P-R-35945-10-5,P-R-35165-2-7,P-R-35143-4-4,P-R-33553-4-6,P-R-33536-12-13,P-R-29809-1-7,P-R-26968-3-9,P-R-18425-8-62,P-R-18426-5-30,P-R-18424-4-34,P-R-53545-4-5,P-R-50711-18-11,P-R-49736-6-22,P-R-48467-18-18,P-R-32106-7-33,P-R-30085-1-9,P-R-29138-38-83,P-R-29315-36-69,P-R-25009-1-8,P-R-24363-1-13,P-R-21631-10-64,P-R-19898-1-22,P-R-19814-1-62,P-R-19012-1-57,P-R-1817639-13-12,P-R-1791446-8-2,P-R-69347-1-5,P-R-64574-1-4,P-R-54116-1-4,P-R-53585-18-18,P-R-52594-18-5,P-R-52386-1-4,P-R-50980-2-4,P-R-50938-1-4,P-R-50152-18-20,P-R-49175-18-22,P-R-47260-18-23,P-R-44156-18-26,P-R-43284-18-19,P-R-43285-12-22,P-R-42482-1-4,P-R-40990-12-15,P-R-39333-18-28,P-R-35439-12-21,P-R-33215-18-19,P-R-31352-12-25,P-R-19279-1-8,P-D-34269-2-5,P-R-49830-18-15,P-R-40586-18-27,P-R-32996-18-24,P-D-40316-9-5,P-R-50429-18-8,P-R-1445924-8-6,P-R-65295-18-30,P-R-61861-1-4,P-R-61737-1-4,P-R-51777-18-8,P-R-50920-1-6,P-R-50366-18-19,P-R-35985-14-23,P-R-35891-18-5,P-R-32004-2-21,P-R-1280425-13-18,P-R-68336-2-4,P-R-67286-2-6,P-R-51513-2-4,P-R-79963-1-2,P-R-52043-1-3,P-R-51764-1-4,P-R-49388-2-6,P-R-48335-4-16,P-R-47308-3-9,P-R-42392-2-4,P-R-39073-1-5,P-R-1123376-10-14,P-R-1009855-12-14,P-R-98856-18-48,P-R-43489-30-15,P-R-38410-12-23,P-R-1565428-2-3,P-R-1249370-4-5,P-R-66436-1-4,P-R-62873-1-4,P-R-51097-1-5,P-R-50706-18-7,P-R-50055-18-7,P-R-49315-18-5,P-R-42660-18-35,P-R-36649-8-9,P-R-1707720-2-6,P-R-42379-2-3,P-R-42378-2-3,P-R-1737786-2-3,P-R-66539-1-4,P-R-66538-1-4,P-R-65278-1-4,P-R-65279-1-4,P-R-59180-1-4,P-R-48070-1-5,P-R-47386-1-4,P-R-55342-2-2,P-R-53377-2-6,P-R-52481-2-5,P-R-49759-2-8,P-R-46100-20-9,P-R-38510-2-10,P-R-37550-20-13,P-R-32186-C27-29,P-R-58135-2-4,P-R-56618-1-3,P-R-56027-1-4,P-R-46145-18-18,P-R-33892-1-8,P-R-33696-1-5,P-R-1356627-14-14,P-R-55749-1-4,P-R-53662-1-4,P-R-52246-1-4,P-R-52245-1-4,P-R-52238-1-5,P-R-43644-6-13,P-R-39912-1-2,P-R-39283-4-10,P-D-1890536-1-2,P-R-50380-18-18,P-R-50379-18-17,P-R-68146-1-5,P-R-63409-1-5,P-R-50542-18-14,P-R-50500-18-16,P-R-48365-18-24,P-R-48161-18-32,P-R-46597-1-4,P-R-33737-1-4,P-E-29662-C1-3,P-R-56654-2-4,P-R-51703-1-5,P-R-50133-2-9,P-R-47242-18-11,P-R-46410-1-5,P-R-45550-18-46,P-R-45490-16-9,P-R-44885-18-20,P-R-42512-1-3,P-R-40169-8-13,P-R-32143-5-18,P-R-37313-18-22,P-R-36664-4-4,P-R-35476-2-5,P-R-35407-4-3,P-R-35237-14-11,P-R-35150-2-4,P-R-35129-2-4,P-R-35056-4-5,P-R-34889-8-4,P-R-34044-2-4,P-R-33718-6-5,P-R-33459-1-5,P-R-30292-4-9,P-R-28644-1-4,P-R-24037-1-8,P-R-23445-3-8,P-R-23434-3-8,P-R-18513-1-30,P-D-34699-4-4,P-D-34697-2-4,P-D-34675-1-4,P-D-34673-1-4,P-D-34654-1-4,P-D-34587-3-5,P-D-34266-1-4,P-D-34262-1-5,P-D-34260-1-5,P-D-34258-2-5,P-D-32465-1-5,P-D-32459-2-4,P-D-32458-5-4,P-R-1856616-16-10,P-R-69529-1-5,P-R-65011-1-3,P-R-53622-18-4,P-R-50541-2-7,P-R-49893-22-9,P-R-36932-2-13,P-R-69232-18-13,P-R-23681-2-7,P-D-32502-2-3,P-D-32501-2-3,P-D-32415-2-3,P-R-64513-18-11,P-R-51916-84-31,P-R-1862954-1-3,P-R-1839655-1-3,P-R-1834985-2-4,P-R-38248-26-36,P-R-1777696-1-3,P-R-1740246-3-5,P-R-1740224-1-3,P-R-25822-16-21,P-R-1694200-1-3,P-R-1633688-1-3,P-R-1551153-1-3,P-R-1547617-1-3,P-R-1479674-3-5,P-R-1280186-1-3,P-R-1267084-2-6,P-R-1245296-4-6,P-R-1157570-2-4,P-R-1132821-2-4,P-R-1119013-1-3,P-R-1098796-1-3,P-R-1094445-1-3,P-R-1080412-1-3,P-R-1069769-2-4,P-R-1068115-1-3,P-R-1045118-2-4,P-R-1044408-1-3,P-R-1044141-7-9,P-R-1037887-1-3,P-R-1037879-1-3,P-R-1036293-1-3,P-R-1036292-1-3,P-R-1036289-2-4,P-R-1036288-1-3,P-R-1036068-2-4,P-R-1035933-2-4,P-R-1035149-2-4,P-R-1028168-1-3,P-R-1009717-3-5,P-R-1000061-2-4,P-R-117548-2-4,P-R-111682-1-3,P-R-105731-36-38,P-R-104435-13-15,P-R-100294-1-3,P-R-99633-1-3,P-R-98929-2-4,P-R-98250-1-3,P-R-94299-1-3,P-R-93077-1-3,P-R-86118-1-3,P-R-80517-7-9,P-R-78112-4-6,P-R-77140-2-4,P-R-76918-2-4,P-R-76721-1-3,P-R-75440-2-4,P-R-73676-1-3,P-R-72449-7-10,P-R-72030-4-6,P-R-68069-2-4,P-R-66975-1-3,P-R-65567-1-3,P-R-62212-2-4,P-R-60602-3-5,P-R-52633-1-3,P-R-52171-2-4,P-R-52011-2-4,P-R-51921-8-10,P-R-51258-8-10,P-R-50752-2-4,P-R-50681-4-6,P-R-50599-4-6,P-R-50596-4-8,P-R-50553-1-3,P-R-49597-3-5,P-R-49458-2-4,P-R-48530-7-9,P-R-47948-1-4,P-R-46580-3-5,P-R-46484-10-12,P-R-46122-1-3,P-R-45858-2-4,P-R-43966-2-4,P-R-43502-19-21,P-R-41430-1-3,P-R-40751-8-10,P-R-40273-4-6,P-R-39238-5-7,P-R-38682-3-5,P-R-37588-2-4,P-R-34355-8-10,P-R-26266-4-9,P-R-26834-3-8,P-R-24662-16-22,P-R-27479-6-11,P-R-26056-7-15,P-R-27006-7-12,P-R-30338-3-7,P-R-30178-79-81,P-R-30053-8-10,P-R-27458-1-5,P-R-25083-6-9,P-R-24690-49-53,P-R-24689-2-5,P-R-24666-2-5,P-R-24663-6-11,P-R-24659-7-10,P-R-23744-7-9,P-R-23739-7-9,P-R-23736-14-17,P-R-23734-7-9,P-R-23730-21-24,P-R-23723-10-12,P-D-32588-1-3,P-D-32534-1-3,P-D-32524-1-3,P-D-32518-1-3,P-D-32512-1-3,P-D-32509-1-3,P-D-32485-1-4,P-D-32484-1-4,P-D-32405-1-3,P-R-1087141-4-7,P-R-49160-12-12,P-R-47601-18-13,P-R-46834-12-14,P-R-46202-18-11,P-R-44018-18-13,P-R-43355-18-12,P-R-35337-16-7,P-R-33916-1-5,P-R-33580-8-9,P-R-1827530-14-10,P-R-59175-18-4,P-R-53292-14-10,P-R-49130-18-23,P-R-46913-18-8,P-R-37449-18-15,P-R-48549-18-11,P-R-19262-1-12,P-E-44774-2-9,P-R-44869-16-16,P-R-33918-1-11,P-R-1712777-10-11,P-R-1649873-13-11,P-R-1641587-1-6,P-R-1583865-1-6,P-R-1563945-1-8,P-R-1128630-1-7,P-R-1098412-1-5,P-R-1091267-1-59,P-R-81720-1-2,P-R-58406-1-5,P-D-50697-2-4,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-6"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|5"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|8"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	integrator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.13 = 207d2c205c2255494d5c22203a207b205c224576656e74735c22203a207b205c224655494d426567696e556e646f4265666f726546426567696e556e646f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224655494d426567696e556e646f416674657246426567696e556e646f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224163636573736962696c6974795c22203a207b205c224576656e74735c22203a207b205c22416363436865636b657256696f6c6174696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2247726170686963735c22203a207b205c224576656e74735c22203a207b205c2245326f496e666f466f72446f63756d656e74436f6e7461696e696e674475706c696361746541727469645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446961676e6f737469635c22203a207b205c224576656e74735c22203a207b205c22496e636f73697374656e74526561644f6e6c79446f6350726f70657274795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22547261636b4368616e6765735c22203a207b205c224576656e74735c22203a207b205c22557463547261636b4368616e67657341646465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2255736572507265666572656e63655c22203a207b205c224576656e74735c22203a207b205c225365744972665c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f70696c6f745c22203a207b205c224576656e74735c22203a207b205c2250726f61637469766553756d6d617279456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224167656e744d6f6465457564624576616c756174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224f6c655c22203a207b205c224576656e74735c22203a207b205c22496e736572744f6c654f626a656374436f72655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225363726f6c6c5c22203a207b205c224576656e74735c22203a207b205c22456e73757265437572736f725669736962696c6974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22456469745c22203a207b205c224576656e74735c22203a207b205c22465265636f6e63696c6550646f645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6e74656e74436f6e74726f6c5c22203a207b205c224576656e74735c22203a207b205c2246456e737572655665637362645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e4368616e6765476174652e4361636865456e726963686d656e74416363657373546f6b656e222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e526573656172636865722e4e6f64654a5357656250616765457874726163746f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e48656c704974656d53706c6974427574746f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e48656c7050726f7669646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e497350656f706c654974656d53706c6974427574746f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e4d616a6f724974656d53706c6974427574746f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e4d6178436f6d6d616e64526573756c7473546f52657475726e222c20225622203a2022696e7433325f747c3422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e506172616d657465725465726d50726564696374696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e51756572794c6f6767696e67456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e536861726564446f63756d656e74456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53686f756c6453686f7748656c70416374696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53686f774f6e6c794974656d4c6162656c49664465736372697074696f6e49734e756c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e57617465726d61726b506172616d65746572697a6174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e5a65726f417373697374616e6365526573756c7473456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4973506572736f6e6150726f66696c65504358456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e52656d6f76654d53414148616e646c6572466f7254657874426f78222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5465616368696e6743616c6c6f757454696d654f6e53637265656e54656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5468656d696e672e5573654d656469756d4c756d696e616e63655468726573686f6c64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f72427573426172456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f725465616368696e6743616c6c6f7574456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e566973696f2e484f50657266496d70726f76656d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e57686174734e65772e454353446174614c6f61646564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304b42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d31304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d314742416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d314d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3530304b42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3530304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d35304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d354d42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d5265616c6c79426967416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e456e61626c655061747465726e73496e41746e74786e64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e52616973655569614175746f436f72726563744576656e7457697468456e74697265576f7264222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d617022203a207b2022464347726f75704d61705f3122203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657231222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333230323b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657232222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838323936373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657233222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373838333231313b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657234222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383434343234393330373934313932373b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b656447726170686963734164617074657235222c20225622203a20227374643a3a77737472696e677c33323930323b303b303b303b383732353732343238343635343239363b323b303b303b303b303b3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e426c6f636b6564477261706869637341646170746572436f756e74222c20225622203a2022696e7433325f747c3522207d205d2c2022464347726f75704d61705f3222203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e476c6f62616c5265736f75726365496e666f4361636865456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e53686f756c644d69677261746546726f6d4f72617069222c20225622203a2022626f6f6c7c3122207d205d2c2022464347726f75704d61705f3322203a205b207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e42697a426172222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173426f6f742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173446f63756d656e7452656164792d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e766173466c6f6f64676174652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6963656e73696e674469616c6f6752656e65772d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c4f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734c6f63616c53617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f444253617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e6544726976654f70656e446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f6e65447269766553617665446f63756d656e742d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163654f70656e2d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d43616e7661734f757453706163655361766541732d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d466c6f6f6447617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f66666963652d496e41707050757263686173652d57696e3332222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54617267657465644d6573736167696e672e456e61626c65537572666163652e4f75745370616365222c20225622203a2022626f6f6c7c3022207d205d207d207d	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "943 6,944 15,1329 10,1329 50,1329 15,1329 100,943 10,1329 6,943 15,944 6,940 50,941 15,941 10,941 6,942 15,942 10,942 6,944 100,944 10,944 50,940 6,940 100,940 10,940 15"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|13"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	integrator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.10 = 3936207d207d2c205c225375624e616d657370616365735c22203a207b205c2243656e7472616c5461626c655c22203a207b205c224576656e74735c22203a207b205c22436865636b536368656d6156657273696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436c65617243616368655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22437265617465446174616261736546696c655573696e6754656d706c6174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2243726561746544617461536f757263654661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2244617461736f757263654f70656e4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246696c65436163686550726f70657274696573526f774e6f74466f756e645c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d69677261746546696c654e616d6546726f6d496e695c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22526f77736574556e6b6e6f776e4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536368656d61557067726164655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224661756c744d616e6167656d656e745c22203a207b205c224576656e74735c22203a207b205c224661756c745265636f766572795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224661756c745265706f72745c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d2c205c2250726f746f636f6c5061727365725c22203a207b205c224576656e74735c22203a207b205c2250617273655572695c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b55726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496672496e697441726773576f72645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248724c61756e636855726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464c6f6164436d644c696e65436f72655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f746f636f6c48616e646c65725c22203a207b205c224576656e74735c22203a207b205c225472794f70656e696e674c6f7248797065724c696e6b496e4e6174697665436c69656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f746f636f6c48616e646c65724d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e7061636b4c696e6b5c22203a207b205c224576656e74735c22203a207b205c22556e7061636b4c696e6b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b4c696e6b4173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b4c696e6b5769746848696e745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225254435c22203a207b205c224576656e74735c22203a207b205c2246696e6453657373696f6e456e64706f696e7452756e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e74536861726555726c5c22203a207b205c224576656e74735c22203a207b205c22556e7061636b536861726555726c416e6448616e646c65526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e556e7061636b55726c436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486c696e6b5c22203a207b205c224576656e74735c22203a207b205c224d736f4872486c696e6b43726561746546726f6d537472696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c6553746f72655c22203a207b205c224576656e74735c22203a207b205c22465344436f7272757074696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2247617262616765436f6c6c656374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225a65726f4279746546696c6555706c6f6164417474656d707465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2252756e74696d6550726f706572746965735c22203a207b205c224576656e74735c22203a207b205c22496e636f6d70617469626c6543736956657273696f6e44657465637465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224f66666963655c22203a207b205c225375624e616d657370616365735c22203a207b205c2246696c65494f5c22203a207b205c225375624e616d657370616365735c22203a207b205c224353495c22203a207b205c225375624e616d657370616365735c22203a207b205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c2243616368654f707469637356325c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d2c205c224d6f6373695c22203a207b205c224576656e74735c22203a207b205c22557064617465486f73745469705c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e46696c6553797374656d222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2246696c655c22203a207b205c224576656e74735c22203a207b205c225265706c61636546696c654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e466f726d73222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22466f726d73536572766963655c22203a207b205c225375624e616d657370616365735c22203a207b205c2241637469766974795c22203a207b205c225375624e616d657370616365735c22203a207b205c22486976654461746150726f76696465725c22203a207b205c224576656e74735c22203a207b205c22476574526573706f6e7365436f756e74427946696c7465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2243444250726f76696465725c22203a207b205c224576656e74735c22203a207b205c22476574526573706f6e7365436f756e74427946696c7465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4772617068696373222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22415243457863657074696f6e53636f70655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2245326f5669657752656e646572506572666f726d616e636541637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224172745669657756616c69646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f6669745368617065546f54657874436d645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f704c6576656c456666656374447261775c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174654269746d617046726f6d506c6174666f726d4269746d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e6b496e70757453757266616365426173655570646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250617468576964656e657246576964656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250617468576964656e657246576964656e53696d706c65506174685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224776697a536d61727441727450726f7065727469657354656c656d657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746544657669636544334431305c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22537065637472655472616e73636f646541637469766974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e73657274496e646976696475616c4d6f64656c334441637469766974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61646564496d61676550726f706572746965735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e736572744d6f64656c334441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22537065637472654372656174655363656e6541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d6f64656c334452656e64657241637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4964656e74697479222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22456e7375726550726f7669646572496e697465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574506572736f6e50726f66696c6553657475705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224964656e74697479536e617073686f745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657450726f7669646572466f7241757468536368656d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472794964656e74697479506172656e744d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526f616d696e6750726f7879496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536861726564437265645265667265736846726f6d53746f72655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561644f6e6546726f6d43726564656e7469616c4c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22435265616453796e635461736b52756e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f6d61696e4a6f696e65644f72436c6f7564446f6d61696e4a6f696e656453657373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744164616c416363657373546f6b656e46726f6d4372656450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6e666967546f6b656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574426c6f636b696e67536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f70756c617465536572766963654d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657441757468656e74696361746564536572766963655469636b65745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526566726573684964656e7469746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765745365727669636555726c466f7246656465726174696f6e50726f7669646572416e616c797369735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365727669636555726c5374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637175697265536572766963655469636b6574466f724144414c5c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2253697465735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e496e736967687473222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74735c22203a207b205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436163686546696c654e6f7456616c69645c22203a207b205c224576656e74466c61675c22203a20323536207d207d2c205c225375624e616d657370616365735c22203a207b205c224f66666963655c22203a207b205c224576656e74735c22203a207b205c2253797374656d616c69645c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22496e7369676874735c22203a207b205c224576656e74735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d5c22203a207b205c224576656e74735c22203a207b205c224163746976697479715c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224163746976697479735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22536d6172744c6f6f6b75705c22203a207b205c224576656e74735c22203a207b205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573345c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573365c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573375c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573385c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573395c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265667265736843616368656446696c65735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446f776e6c6f61645265736f757263655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241757468656e7469636174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526573756c7447726f7570546f52656e6465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e64576562536f636b6574526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22576562536f636b657450696e67506f6e674c6174656e63795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446961676e6f737469635c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2238564d65686c6c5c22203a207b205c225375624e616d657370616365735c22203a207b205c22356b69614b3747426b7a505746675c22203a207b205c224576656e74735c22203a207b205c22373139305c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d20	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|4"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	integrator.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F26D-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3E6-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.2	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.ACE.OLEDB.16.0\CLSID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BE39F3D7-1B13-11D0-887F-00A0C90F2744}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F27D-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F278-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{50E8F6BB-88B7-3F0A-9AA3-0A92927603E3}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{359EAB69-7EA9-3179-B5D8-808A3CA74365}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B46D9062-1DB3-34C7-93D1-5E575E00B829}\15.0.0.0	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10909"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1413"	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B7445770-56D9-382B-9BE4-8259BCFF23B2}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E30E7EB4-4A43-3939-A24B-8D501BED57B8}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{97F81678-ACCD-3F4C-A9F2-52653F4431DE}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000CDB0D-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{5B55D412-0B5F-352D-9600-0F51C75122FC}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{49730545-588C-3E74-9C40-988F149B01CC}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_CLASSES\WOW6432NODE\INTERFACE\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F83A-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E7628700-22CB-3037-A5B9-C6E6F321A1AF}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{069470C7-2FC7-3561-8F3F-B4A4510D2A53}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{98E477B0-5AC3-3A32-8B67-108CCA2440E2}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B7E0677C-2BE6-3C25-8F71-A38E34A4E8BA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F04F-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "19081"	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D5662DFD-B471-3E11-865D-F0177E687E3D}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{490D6966-005D-36A5-B7EF-521A24207E7E}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDEC13B2-0B3C-400E-B909-E27EE89C6799}\MiscStatus	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B9263B62-875A-3E5F-9AEE-B9B277A9495A}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{30F5093A-00F9-3458-981B-0B1993B64BBB}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B4DDD66F-48BF-33C4-B074-F0D61992E186}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1493"	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.ACE.OLEDB.16.0	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6DA2B44A-A4E9-3FD4-97C4-25A08BA583F9}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6D851B33-E263-4602-B4BD-96ED7CB4F542}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E9F1477D-EBE4-3E52-8171-6D2E3AEF58CD}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E119-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}	OneDriveSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9D522B14-60B4-39E4-B4A7-AD4ECCE5512C}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F30CDE62-6AB3-303C-AFF8-C68389732559}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A46E20E2-8904-3FEC-9AF9-FC9CE93CD429}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F1A5FAEC-A966-34A5-ABA9-62C4FBD3D018}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VisioViewerDWGDisplay.VisioViewerDWGDisplay	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{324C24C2-96F3-3D48-A368-11AFBD91C2BC}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{16E571E0-040B-11CF-8283-00AA004BA6AE}\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	OneDriveSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6BA75B5F-0232-3D0C-89F6-BDD84A908540}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B8D3D4DA-C9C9-3C25-A68F-A69AB50C7890}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{858C6BC5-2351-363F-9177-BBFFA86CCB78}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_CLASSES\WOW6432NODE\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A394DCA9-3727-11D4-BD85-00C04F6B93A4}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F2E4-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9BC090B2-682F-3CEE-ADA0-09759ACDE44D}\15.0.0.0	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5108	explorer.exe
7060	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
3056	chrome.exe
3056	chrome.exe
5888	explorer.exe
5888	explorer.exe
384	MsiExec.exe
384	MsiExec.exe
6088	MsiExec.exe
6088	MsiExec.exe
1680	setup.exe
1680	setup.exe
1680	setup.exe
1680	setup.exe
6088	MsiExec.exe
6088	MsiExec.exe
5208	OneDriveSetup.exe
5208	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
4528	OneDriveSetup.exe
3652	powershell.exe
3652	powershell.exe
3652	powershell.exe
5080	msedge.exe
5080	msedge.exe
2252	OfficeClickToRun.exe
2252	OfficeClickToRun.exe
5080	msedge.exe
5080	msedge.exe
3652	powershell.exe
900	explorer.exe
900	explorer.exe
3652	powershell.exe
6424	explorer.exe
6424	explorer.exe
7144	setup.exe
7144	setup.exe
7144	setup.exe
7144	setup.exe
7144	setup.exe
7144	setup.exe
6784	powershell.exe
6784	powershell.exe
5668	taskmgr.exe
5668	taskmgr.exe
5668	taskmgr.exe
5668	taskmgr.exe
5668	taskmgr.exe
5668	taskmgr.exe
5668	taskmgr.exe
1920	explorer.exe
1920	explorer.exe
5668	taskmgr.exe
5668	taskmgr.exe
5668	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

pid	Process
5888	explorer.exe
2748	rundll32.exe
3652	powershell.exe
6424	explorer.exe
5736	rundll32.exe
1920	explorer.exe
3516	mmc.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
3056	chrome.exe
3056	chrome.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe
5888	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
5888	explorer.exe
4180	SearchHost.exe
2480	StartMenuExperienceHost.exe
5888	explorer.exe
4180	SearchHost.exe
5888	explorer.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
4180	SearchHost.exe
6544	OfficeClickToRun.exe
5132	integrator.exe
2252	OfficeClickToRun.exe
5888	explorer.exe
900	explorer.exe
6208	SearchHost.exe
5328	StartMenuExperienceHost.exe
900	explorer.exe
6424	explorer.exe
4264	SearchHost.exe
6236	StartMenuExperienceHost.exe
6424	explorer.exe
4264	SearchHost.exe
4264	SearchHost.exe
4264	SearchHost.exe
4264	SearchHost.exe
4264	SearchHost.exe
4264	SearchHost.exe
4264	SearchHost.exe
4264	SearchHost.exe
4264	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3972	3052	msedge.exe	80
PID 3052 wrote to memory of 2480	3052	msedge.exe	81
PID 3052 wrote to memory of 3892	3052	msedge.exe	84
PID 3052 wrote to memory of 3892	3052	msedge.exe	84
PID 3052 wrote to memory of 1604	3052	msedge.exe	86
PID 3052 wrote to memory of 1604	3052	msedge.exe	86
PID 3052 wrote to memory of 1604	3052	msedge.exe	86
PID 3052 wrote to memory of 1740	3052	msedge.exe	85
PID 3052 wrote to memory of 2372	3052	msedge.exe	82
PID 3052 wrote to memory of 1740	3052	msedge.exe	85
PID 3052 wrote to memory of 1740	3052	msedge.exe	85
PID 3052 wrote to memory of 2372	3052	msedge.exe	82
PID 3052 wrote to memory of 2372	3052	msedge.exe	82
PID 3052 wrote to memory of 3984	3052	msedge.exe	88
PID 3052 wrote to memory of 3984	3052	msedge.exe	88
PID 3052 wrote to memory of 3984	3052	msedge.exe	88
PID 3052 wrote to memory of 3400	3052	msedge.exe	89
PID 3052 wrote to memory of 3400	3052	msedge.exe	89
PID 3052 wrote to memory of 3400	3052	msedge.exe	89
PID 3052 wrote to memory of 2300	3052	msedge.exe	90
PID 3052 wrote to memory of 2300	3052	msedge.exe	90
PID 3052 wrote to memory of 2300	3052	msedge.exe	90
PID 3052 wrote to memory of 4840	3052	msedge.exe	99
PID 3052 wrote to memory of 4840	3052	msedge.exe	99
PID 3052 wrote to memory of 4840	3052	msedge.exe	99
PID 3052 wrote to memory of 1784	3052	msedge.exe	92
PID 3052 wrote to memory of 1784	3052	msedge.exe	92
PID 3052 wrote to memory of 1784	3052	msedge.exe	92
PID 3052 wrote to memory of 3860	3052	msedge.exe	94
PID 3052 wrote to memory of 1552	3052	msedge.exe	95
PID 3052 wrote to memory of 3860	3052	msedge.exe	94
PID 3052 wrote to memory of 1552	3052	msedge.exe	95
PID 3052 wrote to memory of 2192	3052	msedge.exe	97
PID 3052 wrote to memory of 3628	3052	msedge.exe	98
PID 3628 wrote to memory of 4840	3628	msedge.exe	99
PID 3052 wrote to memory of 4496	3052	msedge.exe	100
PID 3052 wrote to memory of 4496	3052	msedge.exe	100
PID 3052 wrote to memory of 4496	3052	msedge.exe	100
PID 3052 wrote to memory of 2516	3052	msedge.exe	101
PID 3052 wrote to memory of 2324	3052	msedge.exe	102
PID 3052 wrote to memory of 1848	3052	msedge.exe	103
PID 3052 wrote to memory of 1060	3052	msedge.exe	104
PID 3052 wrote to memory of 1060	3052	msedge.exe	104
PID 3052 wrote to memory of 232	3052	msedge.exe	105
PID 3052 wrote to memory of 232	3052	msedge.exe	105
PID 1276 wrote to memory of 4028	1276	chrome.exe	108
PID 1276 wrote to memory of 2656	1276	chrome.exe	109
PID 1276 wrote to memory of 2200	1276	chrome.exe	110
PID 1276 wrote to memory of 2200	1276	chrome.exe	110
PID 1276 wrote to memory of 2552	1276	chrome.exe	111
PID 1276 wrote to memory of 2552	1276	chrome.exe	111
PID 1276 wrote to memory of 3516	1276	chrome.exe	112
PID 1276 wrote to memory of 5016	1276	chrome.exe	113
PID 1276 wrote to memory of 3516	1276	chrome.exe	112
PID 1276 wrote to memory of 5016	1276	chrome.exe	113
PID 1276 wrote to memory of 1496	1276	chrome.exe	114
PID 1276 wrote to memory of 1496	1276	chrome.exe	114
PID 1276 wrote to memory of 2164	1276	chrome.exe	116
PID 1276 wrote to memory of 2164	1276	chrome.exe	116
PID 1276 wrote to memory of 3400	1276	chrome.exe	117
PID 1276 wrote to memory of 1052	1276	chrome.exe	119
PID 1276 wrote to memory of 1052	1276	chrome.exe	119
PID 1276 wrote to memory of 4908	1276	chrome.exe	120
PID 1276 wrote to memory of 2828	1276	chrome.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://duck.ai
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ff974b1c188,0x7ff974b1c194,0x7ff974b1c1a0
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,8961192377989505699,8325424701375826982,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,14864337860481252673,3879128296424342524,262144 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,7219312861154105535,5152289807748964440,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,6363603741948077558,15906489067449214793,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,5120106565797029617,10040276635698874254,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11553067552453237248,9711179254906519933,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,12092701510447784991,4515100116192516960,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,12046855349206798106,11129812008691309113,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4396,i,9219458841086075988,10288475817628301544,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4216,i,10980545942792241985,6594370818539698657,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,6121213682294822153,9003971928538703959,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,13875527284146639154,10536374365716421883,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,18202730797374464647,4854298549410440557,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,18202730797374464647,4854298549410440557,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,17402804466276186477,9161268819266846343,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6572,i,4924357328810889694,16453360768494458015,2097152 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2242839389767397622,7379585651702977066,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,14083347367520631476,16843256205941034499,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,10990568239446713256,15804452279745085963,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,16754029470730235682,15042119948560951319,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,6783940767092148395,15802811915987337675,524288 --field-trial-handle=2072,i,7005620449305275424,2380014529753999762,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9744ec728,0x7ff9744ec734,0x7ff9744ec740
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,1717987484339902195,9642464037407884241,524288 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,5393979118660084286,5857523645957324669,262144 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,6031547293417370411,212146973217083529,524288 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,1239298030172923228,15501057814174169825,2097152 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,2194058937028804077,12113100482850742470,2097152 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,13827267264729722814,4458489854634640396,2097152 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4840,i,17765842014002462529,16519516874839047011,2097152 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,12233001166277540517,11450528165872771261,524288 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5764,i,8746649513118490648,7655109748220666473,2097152 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3380,i,9866760146699873848,7982385873420380742,524288 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,911674187909759368,13837998688138602648,524288 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,12957827034853153814,17787834641615591833,524288 --field-trial-handle=2060,i,17221300996126861721,15433919468978503138,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --restart
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:3056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9744ec728,0x7ff9744ec734,0x7ff9744ec740
    3⤵
    PID:332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1792,i,8880978498615290957,4364994010979045424,524288 --field-trial-handle=2004,i,12372368948012606774,18063913793161772439,262144 --variations-seed-version=20260801-030038.357000-production --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1624,i,15424272151078850380,15078598202412872564,262144 --field-trial-handle=2004,i,12372368948012606774,18063913793161772439,262144 --variations-seed-version=20260801-030038.357000-production --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:4948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,8077509822151321919,9469578881133999246,524288 --field-trial-handle=2004,i,12372368948012606774,18063913793161772439,262144 --variations-seed-version=20260801-030038.357000-production --mojo-platform-channel-handle=2628 /prefetch:13
    3⤵
    PID:4516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3580,i,14855457723092085593,8272286098967325526,2097152 --field-trial-handle=2004,i,12372368948012606774,18063913793161772439,262144 --variations-seed-version=20260801-030038.357000-production --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3736,i,14443809283679359156,5174328460583690582,2097152 --field-trial-handle=2004,i,12372368948012606774,18063913793161772439,262144 --variations-seed-version=20260801-030038.357000-production --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,14377971614738979355,2592435922238368204,524288 --field-trial-handle=2004,i,12372368948012606774,18063913793161772439,262144 --variations-seed-version=20260801-030038.357000-production --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:3012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1480
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {7dd7e396-b887-4698-b325-03caf1760bc5} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {5cf80767-606f-41ae-86db-cd522dbd9c03} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 27274 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {f9af27f1-2412-45f3-8ca1-984c6ef3cb72} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27274 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {3e3e537d-db51-4db9-9fbf-36b959766f64} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4536 -prefsLen 34773 -prefMapHandle 4540 -prefMapSize 270279 -jsInitHandle 4544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4508 -initialChannelId {93c97356-98d1-4180-a224-861f8a5ec553} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 35010 -prefMapHandle 4948 -prefMapSize 270279 -ipcHandle 2744 -initialChannelId {8a58f9f0-a4a2-4fe4-ab03-25a7d0b67a32} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32900 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {bd249349-6df2-42d0-a5b2-a98ed03a711d} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32900 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {57efc6d8-df1b-4ec3-a3c2-96049315bf64} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5424 -prefMapSize 270279 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {32d41d68-0af5-4993-8cf8-85ef01184747} -parentPid 4828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5672

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
PID:1372

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3960

C:\Windows\system32\SystemPropertiesPerformance.exe
"C:\Windows\system32\SystemPropertiesPerformance.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
PID:920

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5840
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    3⤵
    - Badlisted process makes network request
    - Drops file in Drivers directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3652
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcfdq0eo\jcfdq0eo.cmdline"
      4⤵
      PID:5516
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6329.tmp" "c:\Users\Admin\AppData\Local\Temp\jcfdq0eo\CSCFF18265B3CE34EFBB0D54BD3E0DFF.TMP"
        5⤵
        
        PID:6688
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\10a1ikqd\10a1ikqd.cmdline"
      4⤵
      PID:2736
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6094.tmp" "c:\Users\Admin\AppData\Local\Temp\10a1ikqd\CSC804985B89C4544F5BDECC42A40D1277E.TMP"
        5⤵
        
        PID:6400
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\store.db /deny Everyone:F
      4⤵
      Modifies file permissions
      PID:992
  - - C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM explorer.exe
      4⤵
      Kills process with taskkill
      PID:3784
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Enumerates connected drives
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:900
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\Users\Admin\OneDrive /deny Administrators:(D,DC)
      4⤵
      Modifies file permissions
      PID:672
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /hibernate off
      4⤵
      Power Settings
      PID:4028
  - - C:\Windows\system32\cleanmgr.exe
      "C:\Windows\system32\cleanmgr.exe" /d C: /VERYLOWDISK
      4⤵
      Enumerates connected drives
      Drops file in System32 directory
      Checks SCSI registry key(s)
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\FC79A053-46AF-4EF7-8E60-F62A725D1A1A\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\FC79A053-46AF-4EF7-8E60-F62A725D1A1A\dismhost.exe {02FBBCD6-0795-4694-9FFB-FA210DB490E0}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6180
  - - C:\Windows\system32\Dism.exe
      "C:\Windows\system32\Dism.exe" /online /Cleanup-Image /StartComponentCleanup /ResetBase
      4⤵
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\B01AF941-2CB9-43F4-8C18-215ED73329F0\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\B01AF941-2CB9-43F4-8C18-215ED73329F0\dismhost.exe {999C33ED-DEDF-4912-9580-DE283A73A348}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:748
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /flushdns
      4⤵
      Gathers network information
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --uninstall --system-level --force-uninstall --delete-profile
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Installs/modifies Browser Helper Object
      Drops file in Windows directory
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:7144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6561704c8,0x7ff6561704d4,0x7ff6561704e0
        5⤵
        Drops file in Windows directory
        
        PID:540
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      Power Settings
      PID:6240
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /setactive da69c5d2-fa47-43bb-8167-cec76e2f1f68
      4⤵
      Power Settings
      PID:5396
- C:\Windows\system32\SystemSettingsAdminFlows.exe
  "C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
  2⤵
  PID:3408
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /qb /x {AC76BA86-7AD7-1033-7B44-AC0F074E4100}
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe" --uninstall --system-level
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff60ca855a0,0x7ff60ca855ac,0x7ff60ca855b8
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe" --uninstall --system-level
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.google.com/chrome?p=chrome_uninstall_survey&crversion=140.0.7339.81&os=10.0.22000
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff974b1c188,0x7ff974b1c194,0x7ff974b1c1a0
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,5267839173191904968,8288558986308072250,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
      4⤵
      System Time Discovery
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1480,i,8378603058174156306,13936031228988788120,262144 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,7286231717795260794,8100624791006475873,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,10390666402294445686,10154654076326683186,2097152 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5091001812085619829,18403803424660596544,2097152 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,10108225801708970812,1795786717105465422,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,12228260441057828016,2734260293501367072,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,3205761219223942307,4340204414515772069,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,8876124231187440798,5994373058664099395,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,9515903003381032033,5197450083184673774,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,9515903003381032033,5197450083184673774,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,18247464268113266557,6981897548508340115,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,8722441384469101314,5324450511608080327,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,17156856801569932066,5513547320998096815,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,1778562819314970717,14617064139471663060,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,427471336663500467,2187108792330531298,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6726161150987540320,16603704843193275393,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,15862013270312193758,1584297061869069365,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,16316770942756114486,15818634276837031035,524288 --field-trial-handle=1856,i,13543132677717866317,8852908674752665022,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff974b1c188,0x7ff974b1c194,0x7ff974b1c1a0
        5⤵
        
        PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,8821116082761312643,6525277081212045412,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1616,i,15528827108307621596,2538925134344046888,262144 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
        5⤵
        
        PID:2804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,9718462704312714495,5929065544438938194,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
        5⤵
        
        PID:2216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15089482214916736757,17294820030132171330,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
        5⤵
        
        PID:4284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15089482214916736757,17294820030132171330,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,15597625114082725019,17370539026313636013,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,15189349896295567317,6827858476364358705,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
        5⤵
        
        PID:2840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,12824690996122153927,18408480821195254764,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
        5⤵
        
        PID:4088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,7639369085797494558,18082953723490473271,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
        5⤵
        
        PID:6752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,1635697826168678471,11618027390142603505,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        5⤵
        
        PID:5936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8261358795220434463,3933976721141316022,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
        5⤵
        
        PID:5708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8585307246904399179,12887542907349019545,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
        5⤵
        
        PID:6960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,8222873899842343921,8852367871167937742,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
        5⤵
        
        PID:5668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,16578976220606548775,13869379102279667484,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
        5⤵
        
        PID:7112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,387786176205672312,7811510792232938343,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
        5⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,15091773872455213239,14729179090533941235,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,9322403850661147634,17521212518755200364,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
        5⤵
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,8955464101895737940,12377288675311662975,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
        5⤵
        
        PID:6852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,5135986590894885830,15389034459991955926,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
        5⤵
        
        PID:6668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,11331759983036275534,11649388115155421371,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
        5⤵
        
        PID:7096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,14500631862904506300,9868381843665217096,524288 --field-trial-handle=2216,i,3026071861570510020,10610268647738901359,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
        5⤵
        
        PID:5384
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" /uninstall
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe /uninstall /permachine /silent /childprocess /enableOMCTelemetry /cusid:S-1-5-21-1679180529-4058988202-686829476-1000
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3304
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry
    3⤵
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4528
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall
      4⤵
      System Location Discovery: System Language Discovery
      PID:996
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" scenario=install scenariosubtype=ARP sourcetype=None productstoremove=ProPlusRetail.16_en-us_x-none culture=en-us version.16=16.0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  PID:6544
- C:\Program Files\Mozilla Firefox\uninstall\helper.exe
  "C:\Program Files\Mozilla Firefox\uninstall\helper.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1688
- - C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe
    "C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe"
    3⤵
    - Executes dropped EXE
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\Mozilla Firefox\uninstall\
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:1900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask uninstall
        5⤵
        Executes dropped EXE
        
        PID:6524
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask uninstall
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:6300
    - - C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        
        "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" uninstall 308046B0AF4A39CB
        5⤵
        Executes dropped EXE
        
        PID:5308
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent uninstall 308046B0AF4A39CB
        6⤵
        Executes dropped EXE
        
        PID:6504
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent uninstall 308046B0AF4A39CB
        7⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:6768
    - - C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe" /S
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe
        
        "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe" /S _?=C:\Program Files (x86)\Mozilla Maintenance Service\
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" uninstall
        7⤵
        
        PID:5480

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2480

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4180

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
PID:920

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1772

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3316

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
PID:5108
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL PowerCfg.cpl @0,/editplan:8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:356

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops desktop.ini file(s)
- Enumerates connected drives
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4752
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9E48AB3DB1AEB4BB35C7EDE57EA4A54
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B396B9475B68763DC47289BCC24354A7 E Global\MSI0000
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Indicator Removal: Clear Persistence
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- C:\Windows\Installer\MSIC686.tmp
  "C:\Windows\Installer\MSIC686.tmp" /b 3 120 0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4448
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1728
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 624566BC84004FD02A5DC576E17E1E5B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4520
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6372
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3264
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4092
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6352
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6220
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"
    3⤵
    PID:5800
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6280
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6620
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"
    3⤵
    PID:6448
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5284
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6744
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"
    3⤵
    PID:6872
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"
    3⤵
    PID:6776
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:576
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3720
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"
    3⤵
    PID:1792
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6920
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7116
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5664
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"
    3⤵
    PID:2664
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6908
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7072
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"
    3⤵
    PID:4240
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:5880
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2624
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4596
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:588
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:544
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4684
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4092
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6348
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6220
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1496
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6384
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2056
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6376
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6484
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2004
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6640
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6948
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6972
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7148
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5380
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4552
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:900
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5636
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1032
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5664
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5192
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6908
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5384
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7072
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3420
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6180
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6508
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5000
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1372
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2252
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"
    3⤵
    PID:6008
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6316
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6220
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3956
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6384
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"
    3⤵
    PID:4252
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6376
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5492
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6820
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"
    3⤵
    PID:7032
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7080
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7040
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5668
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:4244
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3256
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5764
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2784
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3676
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7064
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"
    3⤵
    PID:5504
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2356
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3564
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3448
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"
    3⤵
    PID:5024
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2624
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"
    3⤵
    PID:6528
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"
    3⤵
    PID:3232
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"
    3⤵
    PID:4868
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"
    3⤵
    PID:6216
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6228
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"
    3⤵
    PID:5144
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6260
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6316
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6620
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6384
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:2056
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2116
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1608
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6792
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3100
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4708
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:576
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5104
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7148
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4464
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1940
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7116
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5736
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4896
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6108
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2868
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2164
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:540
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6180
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4596
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3348
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3252
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6348
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4684
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2588
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5500
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3956
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6404
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6408
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4252
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6656
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6832
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6744
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6992
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7068
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3100
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6972
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4624
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:900
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:5884
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 9F4B0E640406F9644B8321445ED76A20 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:6608
- - C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe
    "C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe" -standalone:temp
    3⤵
    - Executes dropped EXE
    PID:2100
  - - C:\Windows\Temp\ose00000.exe
      "C:\Windows\Temp\ose00000.exe" -standalone
      4⤵
      Executes dropped EXE
      PID:4480
- - \??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    - Drops file in System32 directory
    PID:788
- - \??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:5164
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 600CF478B56BF62913B14230C1E2D2BC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:3124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3664

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.BingNews_8wekyb3d8bbwe
1⤵
PID:4712

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:4188

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"
1⤵
PID:7048

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
integrator.exe /U /Extension /Msi /License PRIDName=ProPlusRetail.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Manipulates Digital Signatures
- Indicator Removal: Clear Persistence
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5132
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"
  2⤵
  PID:5884
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"
  2⤵
  PID:7116
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"
  2⤵
  PID:7064
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"
  2⤵
  PID:7072

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /standalonesystem
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2252
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates"
  2⤵
  PID:6360
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates 2.0"
  2⤵
  PID:2972
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Subscription Maintenance"
  2⤵
  PID:4932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6404
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office ClickToRun Service Monitor"
  2⤵
  PID:6452
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Microsoft Office Touchless Attach Notification"
  2⤵
  PID:6480

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5328

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:6208

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /q /c rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013"
  2⤵
  - Executes a command shell one-liner
  PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Badlisted process makes network request
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:6784
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2wrexsna\2wrexsna.cmdline"
    3⤵
    PID:1544
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BE6.tmp" "c:\Users\Admin\AppData\Local\Temp\2wrexsna\CSC7314707652814A738DE86A9A942571A.TMP"
      4⤵
      PID:6356
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z4ns0ucx\z4ns0ucx.cmdline"
    3⤵
    PID:4836
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C75.tmp" "c:\Users\Admin\AppData\Local\Temp\z4ns0ucx\CSCB40CD6A860A645A59E5A187FF399810.TMP"
      4⤵
      PID:3660
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5668

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6236

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe
1⤵
PID:5328

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Edge.GameAssist_8wekyb3d8bbwe
1⤵
PID:2592

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1716

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:7060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL PowerCfg.cpl @0,/editplan:da69c5d2-fa47-43bb-8167-cec76e2f1f68
  2⤵
  - Power Settings
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5736

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:7088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2164

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5460
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1920
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3516
- C:\Windows\system32\OptionalFeatures.exe
  "C:\Windows\system32\OptionalFeatures.exe"
  2⤵
  PID:2084

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
PID:4060

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4744

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
PID:6556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5fbb2d.rbs

Path C:\Config.Msi\e5fbb2d.rbs
Size 1.7MB
SHA256 c2f6e32a10f95de98c3494ee5b45190d7ebe98437047c0715ef744f9f0472be6
MD5 da0b7bbe25b00d9b6fc7dca7af453955
SHA1 67c77e8a819d3d1b6ab83dd7048facf743fe9efb
SHA512 8f47f22beb08bf6e9335b3f37591c0daeb0a76fcf80fc3da054b81ab418d6cc32be48ecbd7f1ab5822177f53ca0ad914e6906dc87fb6bb854867d491d8d06f9a
SSDEEP 24576:v8zSfVRLHakEp8zSfVRLHakEf8zSfVRLHakE4+:Ky3LHar0y3LHar6y3LHar4+
TLSH
T18085C74267D09061F1F71B70E9B64B267F37FDB09AB2810F8358851E4E72780BE66B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbb2e.rbf

Path C:\Config.Msi\e5fbb2e.rbf
Size 2KB
SHA256 cdcd8f6f0ad5b4e57be8afe0faec45dca99ca3954255080132a4c39620c68373
MD5 9fccf11f8aad89b2b9bc7045a46e4fc1
SHA1 ff4aee5d40f2ce81e09c6c7e20c60fe3a3df3724
SHA512 47c2a9c294175623bba2678013b2b496c99fe5371c78bf584ce2cb69f6bee0d53235fdf5158d485cb384bcff528f8f42ccc79d86de286fddfc8039d8eac2e341
TLSH
T1EB5181A007FA171BE3739AB677E21A23E931BDD66A008E5E514843930725601D997E2E
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbb2f.rbf

Path C:\Config.Msi\e5fbb2f.rbf
Size 2KB
SHA256 c4469e7fc6ad8b9c3a51c5378bfa05ba7f895b3a18da8226d63e6fa4a1c2d632
MD5 bb01ddbbadb337cd6c9ce1b659d27790
SHA1 1786f1cac9537f5b5ff29368f962b710df198ce7
SHA512 aafb31e4edd911475850ed66cc55faa30357ad0279a8da62583100e738589928cc93406f2cf45ab2ac8dafaeeb601bef959a88742b1457c8895f51d709212ec0
TLSH
T16641E1504AE72717F3779AB6DBF21A21EB21BC01D2094E1E054853571DA1B00D9A8F2F
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbcde.rbf

Path C:\Config.Msi\e5fbcde.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5fbce1.rbs

Path C:\Config.Msi\e5fbce1.rbs
Size 2.8MB
SHA256 893020cb18a4682e40ed96c87257153f888cdf59d5a55139ddeac140b371b8e3
MD5 568663e64ddc69ee2dbc33ec40beceb0
SHA1 aa084b2bb9fdf11ed6bb5e1dc6d6e8155c25d4a5
SHA512 ad2c21effdbae726b81d647c9ea3fec2f7dfa57f33597f5a07d098a8939bafd84d2bd1f6dbe06a7bee120ce2b8fd18ef34953531e6fae890ea31b00ecea3dc3d
SSDEEP 49152:PRzeTVeTRhwNUbuhwNUbYhwNUbThwNUbxwLs0Nn:deTVeTLOk9SLZ
TLSH
T1A0D5D702B6809592D4E71B70D8A70B567B36FAC997B1878F411CC2384E53BC76E7AF06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd10.rbf

Path C:\Config.Msi\e5fbd10.rbf
Size 446KB
SHA256 5512cabd57b6e1fbd2b96c298d804a3795cd317f61e154aedb335f6c119eaf62
MD5 745897fc2816625a0e5f1ac0f9af16a2
SHA1 cfa9d4dbd1a5bc728ed712cef8b3fadc903d111b
SHA512 7053e9c95b943a30006065a66830bfeb0f37dfb185fcc27019c205e3cea358a0f71ff8007cb6aa39bf61e3406e989ac8366226d83dea5e37c429a5242d1786d2
SSDEEP 12288:MbyNY0P7xwmwdQHdZ+z0wLZbwGlrVcyjlNSOnR5:MbyNY0P7xwmwdQHSxZbwGlr/5
TLSH
T12EA4F9167A2EA017DFC9C77D15B3BA5457B9F1410EE6EF06110ED26CAF83284EE026B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd11.rbf

Path C:\Config.Msi\e5fbd11.rbf
Size 850B
SHA256 ecb94457c6327a56138dee83fcd82e61352c45e7097309a2effc694e5e78d1e8
MD5 485f3cd5a94355f8e6b0aa101abd9f04
SHA1 a91650f4f103fdf08c8c261cdb1746aca658229e
SHA512 31b1746d7491d4be907bfe966cecc43f9fac099f897f423cf0b85bef4846a325d209ab64408edfbbd110ca3d3d61644d0cd547e431ae6e6ccd5a74cd9dcaa794
TLSH
T16C014C1717EC1204F1F65B14AAB914715BA2FC05AC29CDBE10B0590D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd12.rbf

Path C:\Config.Msi\e5fbd12.rbf
Size 11KB
SHA256 588aa09f39b70d191b92c2414217429a2fd21c4fb7c3f21fa1d57ece2f552209
MD5 7e23e2abf1e03fd0d3c0ed71d3e67201
SHA1 77e9ff622eb2b07d4eb908146251d2061895fd47
SHA512 14496dcaaccd6b00b156d26691465f6fb85da94b04d0a804ad22a8f42d992ef201c4c92b87e2c9d6e5b80ffe53049ed8b44d67ec304bd604d18f6204590c7bb3
SSDEEP 192:DY43KXtW81Qo1xcW++sPJ9Nrs/nGfe4pBjSTV:eW8P16Wy7h0GftpBjo
TLSH
T10132E85187BCD243ECF35E7066B1CE837D3CEB929D21532A40A9D2592C937E4DB20B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd13.rbf

Path C:\Config.Msi\e5fbd13.rbf
Size 850B
SHA256 aeb0afc185056f716552564e277ef8a6740a4e7f1600032153eebffae18b3ed2
MD5 57626036538c8abbf5bc761c8ecbb274
SHA1 f3dc829a302cd7e268b566eff47b9c5b3badc33c
SHA512 2d508dc1d441187d18502f3d470a27cc8a34af5b16a97db713a2c34801ad65eaf4e15e7b13fb216c11ef4ce505e438e4dd49c326e8217341735ecfbedbdcd330
TLSH
T1BD014C1717EC1204F1F65B14AAB914715BA2FC05AC29CDBE10F0590D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd14.rbf

Path C:\Config.Msi\e5fbd14.rbf
Size 11KB
SHA256 53bb64373a30ee2b7b2d2fca25f1d0047fee7d932f351d902041b3d5fad6016b
MD5 642d05fef3999b47e67a3b979395d87d
SHA1 0806dda798421528f8e61e81ac4aadd20cc101e7
SHA512 7f362c47552e0e31c1361f5cd81c94a7e3b1755b4c336b36275a4f42b77ddc775ad5c46e5aed5659f10beef92f228d52882b1fc421bba093373df82f110e2b2e
SSDEEP 192:GYEdKXBW8Uxo1QcWB+sPJ9Nrs/nGfe4pBjSTco:NW8P1pWD7h0GftpBjA
TLSH
T17632F94187BC9243ECF39E7066B1DE837D3CEBD28D21962A4099D2591C967E4DB2072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd15.rbf

Path C:\Config.Msi\e5fbd15.rbf
Size 850B
SHA256 5256b74f3447a7fdbaab2ebe6442160dd617fb10800fd0045895b280f603604a
MD5 fd580865ff5b65ffeead3da78f9d244b
SHA1 f26c08181b87d1a6979f97293413d25f6f2862e3
SHA512 5c7dd9a96db711627e4e2f0bc57bc56a1ebd22d8063cc6b8d5d10ad86104b0aaef52fc17e84ebd07d902d345931aeb33e8ba1dfc334e8da251b538e5e8fb10bd
TLSH
T1E9014C1717EC1204F1F65B14AAB914715BA6FC05AC29CDBE10B0590D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd16.rbf

Path C:\Config.Msi\e5fbd16.rbf
Size 11KB
SHA256 a1cbfc3eca8b075ce204c629bf0cf36b0add593c8a28040018319e5e2533ffdd
MD5 1c213c5e8828353641cef6d74ee6838d
SHA1 6e16eb31f642327afbed7b8d4ca56e791b799cca
SHA512 7b7a222c49a95cea34d8ea005302295572a9955a396bfb51e929a83fd351a67c55c4b8c1647eeb0d4d7bf5e9b0c9502d7f4f4e75970e5b004bb72b4c5c2abf43
SSDEEP 192:rYUlKXpW8eno1ycWl+sNPbLrfs/nGfe4pBjSTh7tA:8W8P1PW5/L0GftpBj07tA
TLSH
T1A232E941C7BC9343ECE75E7066B5CA837D3DEBC29D21532A44AA91591C93BE4CF20B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd17.rbf

Path C:\Config.Msi\e5fbd17.rbf
Size 62KB
SHA256 a8f8ab6c63c8d4471d158010f18cb24d4d2ccea495a160cdcef95a96183ffc6a
MD5 b4c6016286bdce7c51c3634999f2ea5e
SHA1 c446378afc6b12c372bf4dbf33efa61e9f7fbbda
SHA512 a121b4df2348ef53413b82c69a66ad3654aaec7d40011dfa4968f9a6b9a5e1252089f39f4961f2305a678c227abc14bac88a3674ab960fc52f71f7c3776c928d
SSDEEP 768:XS96HjFdl4tKWMUkK21qryk8D7gvLtVR2I5DKeKe0jpJ9pd8iv:i96HjFd0hgzkOgvZjc/d8g
TLSH
T1F653D75A35668016E4500BB1C2A37AD517FDF6032AF7EF1FC65DA0594F833A0CA46BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd18.rbf

Path C:\Config.Msi\e5fbd18.rbf
Size 880B
SHA256 45526926c328fd96d9be162238b22694fc496d7a946c0e5a085b83257e7e25e8
MD5 dcc6434e76ccc91fa6c35df0d0d6f5ce
SHA1 ed1d50016a7db340208145d988a82ce7c126cc94
SHA512 90e08c83dfc95cac80150ebda86085ed2dc86fbc1b2f1112de15638f548e2eb4fc954e3ecc17d828a1a6ed549acde8a1f8ded666865d46ef30eb026127c8b102
TLSH
T16411692317EC1304F1F65B14AAB914715BA2FC05AC29CDBE10B0190D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd19.rbf

Path C:\Config.Msi\e5fbd19.rbf
Size 11KB
SHA256 01cd704e1fb542c10b368985c57204b1f78f1d61b07ae6cb193b47aab12cf663
MD5 2317370717a6bf28b9af805dc45ae5c4
SHA1 ae6876ee8672be7ef18ea64af2293e0d4bf8703a
SHA512 5257384b0e7d49852786f81b03d5cbf4026705c1ddf0c533faac970d92cc9e7b9f3a954bde5eefda6c883bbaeb7feda50292245fed9fd1e5914a404d66357ec4
SSDEEP 192:NsrKXrWk+kWt+s3LP0nWxs/nGfe4pBjSjKRG:5Wk+kWzMnC0GftpBj8
TLSH
T15932E9818BFCD313ECE35E7065B18E837D3DEB925C21921E40A9D2591C977E48F2071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd1a.rbf

Path C:\Config.Msi\e5fbd1a.rbf
Size 880B
SHA256 384f7c7d81020a72029972324ec6d8b84dbb3f342418c15e0833db02174416c7
MD5 f35d405459f10fd3d1f52f6dd64252ca
SHA1 5f3bf4ab1c25ec54e79afe7f92390a624ae5cf14
SHA512 2bf358ed9e7c09f49280bffb7e200d93ecd3de99d0a842bdbb468b808383aa16f444ad8888f030d1bad5e00fd49c7c3d01a72a256c96aadcab04dba59fbe0a7e
TLSH
T17A116D1717EC1304F1F65B14AA7914715BA2FC05AC29CDBD10B0190D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd1b.rbf

Path C:\Config.Msi\e5fbd1b.rbf
Size 11KB
SHA256 8b8be00e22af7c415c0086e48c6ce86ec5d146c75a43829ead4a82d25b5ff636
MD5 3e3b6511ef707e9d2344b320407ca1da
SHA1 af55e484ad47daeeaedc5efc0d301ed8d6a7be16
SHA512 a14250cf607d8d3bde7b9f118bdebcda8deb1b4866042be3aa4d266fcc4734f47f2398c6635d4884d16935c58df6e3a64c68a6196e9892c0c6e2195904cedb30
SSDEEP 192:9UsGKXbWk+3Ws+sNPbLrfs/nGfe4pBjS7x:pWk+3Wg/L0GftpBj
TLSH
T18432E95187FCD313ECE75E7066B6CA833D3DEFC29D21961A04AAD1591C93BE4CA20B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd1c.rbf

Path C:\Config.Msi\e5fbd1c.rbf
Size 880B
SHA256 ff729c37c44b93705b3d7f3e07a35e1debb5deb6be7a00c0a82546d0fb88c0e0
MD5 5fe646e5f52a6183027c87160b922e2b
SHA1 53123095d2ff679db51a55961e7efa6f3c2cd09f
SHA512 a8e7b4f06fd7a2f46d75ba2a43e924aec6d6e270a0ab7b6a3f6cb259d33f7ac78b00ecc6d6b39e8f0433dd35894972790c43d81c7177bfd72decff8a4a768ea7
TLSH
T1B111692317EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B0190D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd1d.rbf

Path C:\Config.Msi\e5fbd1d.rbf
Size 11KB
SHA256 6c699e95e7a018673fe586f5b96ead5bff5861f22699049d72d92ecb53497a47
MD5 9473054628d25757f804cc2584a931ac
SHA1 1ec0e971be84d5e980988c16e1dba3b5323e7ca9
SHA512 668ac3365f98ea2c6ba58d13017dd4a2f8ae28dc4bd8e8d72ee6fcfc3a7b51bf0b3f658e8a95c6f5bd2015000f3a347ca417915d99ca4fb7f4a98271a27ad1ae
SSDEEP 192:2shKXzWE+xWC+sNPbLrfs/nGfe4pBjS75:MWE+xWS/L0GftpBj
TLSH
T16D32E94187FCD313FCE38E7175B5CA837E3DEB928D25962A04A6D2591C937E48A2071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd1e.rbf

Path C:\Config.Msi\e5fbd1e.rbf
Size 13KB
SHA256 45bdf89c40a35f2bb5e8a49a8fe3b67a9984adb4f65bc40ebf4e320c50194218
MD5 d80746b2f94a3a28e380735d4b8a9ea3
SHA1 adf85a8d951e2ef30100f88bd072d333839462ad
SHA512 cfc016d2f98385f407d660e276e31891939792d7de667dc8fe0faff37e38fa7f02b55526084682c75d474757c2dd790b714ac2fe1300f39f54fea61b4b3780d1
SSDEEP 384:xpTOa1d+PE1onB3y8qoyoLRwArUvUS72O+WFWW:xr1dG+oBC8q4lwAoq6
TLSH
T18D52E705B328A13EC98D133AC36B47510F309819B6A2CF2709ED55EE7D12D536D8736A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd1f.rbf

Path C:\Config.Msi\e5fbd1f.rbf
Size 7.6MB
SHA256 e3ba35c5572761c20eb59e25b2332a0cdfb726c48963d40291d7f977531e47a3
MD5 5440ee9cd44616d60cde57ebdb286e95
SHA1 bb7635d6911311b2f3a637a2e9d8446fd0698678
SHA512 4600215bd9788b30aa5a5038d6749aa294ca0d6d0063335979d2f4acc29af09967a9160bfd8a2ae093f7fcb95c80fd51ce832cb639354360965d0202a044e1a0
SSDEEP 98304:4pkg8hn8AiyAB84gPjKVuH62NhND7BMe8Al:4pkg8hn8DStD7BMe8Al
TLSH
T1CD869210B7106460DEDED33BFA9B0E546FBD92120735EF52298CB6B2D25B3825D82376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd20.rbf

Path C:\Config.Msi\e5fbd20.rbf
Size 4KB
SHA256 fd12cbad7d1155b311d97dd5da05869200c50e7698ce997cb96004f18018ad2e
MD5 aaa2e20588e154a10747bf1b31b55125
SHA1 03cf9f79b9cacda13aeb644a88180222240b6f0c
SHA512 29df908a09bfd551c50a3c64074c88814065b5b4cdc0d8a1fda5b1d01cb1f1597f2b71b343b59b9fe99ec7123fe48f9a83f93c0880275c19969523a8bd56dcaa
TLSH
T16B813F6233E4053BF4734B7868A79F853625FC14DB30C72F0598A25F7C64914AA76B32
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd21.rbf

Path C:\Config.Msi\e5fbd21.rbf
Size 108KB
SHA256 e2386b60a73fa7c95a8968161fb1c84dd9143462b2880133778a3027f75730f2
MD5 7ecb661f50f34a941a44dac7241f7d08
SHA1 772b0df3ad4a89a078cd4ff8e5f45115778d04a2
SHA512 aa007a71da51b145a7fc702a0cd8930d43e03a884c331afb48de01e82e06c20d2a5325aaa893d03a25e5b670e9e0a03f002b55d9620202b6b48045e4a79b577b
SSDEEP 3072:hwfedMeM6hIHUBcDudgvSf4OhCsXTgME3bw:hwfedMT6hIHUBcDudgvSf4OhCsjgd
TLSH
T1C7B30802B26C0432D99846BD9267A7314370F63566D2CF4B226DBBE25F53783CE067B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd22.rbf

Path C:\Config.Msi\e5fbd22.rbf
Size 16KB
SHA256 d6cdf961c6d2712fe1958815e51a30960d79fff1e97788b7741627dba972e8f7
MD5 e1eeb7e26ab04075eecc7275239b20b3
SHA1 ba62b37d4233b88948fdc2ffed08f3c82e8627f1
SHA512 dd64909c983794c8ac6c33b74711a89b3b33e4429bb5a3a2a2b4e38f5d74902b1589a97014a35fbaf97b469fa57a11314c02d68e1db0934de5244308699fc262
SSDEEP 384:KxbmnjOXjWQCEKxeiQCR3xbLslvpNj452WFWW:umnj8jWteByhQfNj4H
TLSH
T18D720921BAACD03ED956473D50233B046676F557A323CF1B12BC816E6F8149F98E2B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd23.rbf

Path C:\Config.Msi\e5fbd23.rbf
Size 4KB
SHA256 b342088c8a4403092703bf40062041265e12edd204aff4f6532226478a65cbb2
MD5 f8d11c60b70acd2ec9154ee676f615ba
SHA1 a869fc75f44438d9207511dc73bae976f558ba6e
SHA512 c4c324e22ff7570c6d9a6fcd5ea3bfc4917a404110b3e202be847355c57c189096feb5c37c0a36c541f4a9d9e80bb1f1bc5db3f4146e515ba34468c5547ba907
SSDEEP 48:6H73BCKHGta7+hUGC9tkfY66hd+IvC+GbzActhIZWi9fOTAS5WPxC:oB0tphUGCPj663xvObzAcLEWjHWP
TLSH
T1C891601267A90737F9BB87786CE203856335F8249B25D22F2468221D3C22A549F70FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd24.rbf

Path C:\Config.Msi\e5fbd24.rbf
Size 78KB
SHA256 82589b2d5ecae5ddcda39076a33180b6cddb7f54a0cffd4329087eb1f507bed6
MD5 5f0934c524364c1e1a77db8ccb832c5e
SHA1 848eec26bf024a7c350bdb02d0e92116a4882b76
SHA512 1ac672272b16a6bfd3977886fb773a21d8606a873478ff036a462728d18b59e9c68a08606e1f869b7e6606416b74c90c72ff9be33036371282564b0d3723a222
SSDEEP 1536:fPvuNoP7wauetuprFx/EqKGHgd9C3a69:fXuNCwa10prQqKvC59
TLSH
T10573F917B90D8126ED1847B800A35F902FBCEA4336A1DF2FDA5D53AA4F473885D816F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd25.rbf

Path C:\Config.Msi\e5fbd25.rbf
Size 908B
SHA256 10913008d1befd194fc4c96cf0ea20112e9e075974ff5420557141b7ffd5198f
MD5 0ed609c8782c37c67a5ca7233f08d103
SHA1 c286345aae83608005c0e20aa000acdbfabbdac8
SHA512 92d4547b36cf76823bd9658cc8476afa33f1b20425fae2bd05ea353b6d4de6929c5b72f10100aa1b11493c177df0526aefd1e7d3fabc10d848b88d9f0a382d9c
TLSH
T1C2113C1717EC1304F1F65B14AAB914715BA6FC05AC29CEAD10B0190D89A2E50ECA2FBB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd26.rbf

Path C:\Config.Msi\e5fbd26.rbf
Size 11KB
SHA256 f259988c45f54338d57175fcf4fb9f895d484a4eb0c4b861a3abe885c263be66
MD5 524014d39a54d3908de59807c09cae3b
SHA1 cc166f76626f94cdbabd8095286a82a474af9f8e
SHA512 02bdff78beab753a58f46579e61ad4d2953475edb53b57f75ed4828ff04d9641f114357f11059ae28d82c1d28f7433a4eea7b7cc01c1fcf85bb5dc6d58261182
SSDEEP 192:yTEKXzWYL/0czWB+sPJ9Nrs/nGfe4pBjSjbom4:UWYL/0czWD7h0GftpBjUom4
TLSH
T13C32FA5183F89343FCF75E7025B29A837D3DEBD28D21976A0095D1592C92BE0CA30B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd27.rbf

Path C:\Config.Msi\e5fbd27.rbf
Size 908B
SHA256 e34e79770b6a3a4ad1583c9a90ac12aa4348ad134366c0b0436f00162fa41734
MD5 d2bc82e2f203cc4778ff312475a1d37a
SHA1 2da7e8f3e8e4189acf5624bead6b7b983af17e5e
SHA512 976b018f717e45136be48ee8b4ba2593f88e5ca3c6d14602621d2a394d13bbbd6e707ee3a611442caadc3f5f1ac1a8de87b0407da8178a74d25404cee3d9657b
TLSH
T134113C1317EC1304F1F65B14AAB914715BA6FC05AC29CDAD10B0190D89A2E50ECA2FBB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd28.rbf

Path C:\Config.Msi\e5fbd28.rbf
Size 11KB
SHA256 3d004ae76cdc99ece59a0dfb980182a727635459eefb4590d8e2c80ac3115b44
MD5 c1e58c73d935540d0673dffb303aca5b
SHA1 2a95a12c512a2aaf29587db1ec4271cb92846bed
SHA512 471b7f432369940d1854dfe50a71e06df25550704efc4f83c60815bc017dc19f875e2ee3733a9750de4e79c6413db59e762df42777b945d0bc045893604b23c3
SSDEEP 192:ljTpKXjWu9/0qzWv+s3LP0nWxs/nGfe4pBjSbtpl:wWu9/0qzWpMnC0GftpBj+pl
TLSH
T19732D94187BC9303FCE35E7126A59E837D3DABD28D22962E0059D1592C97BE4CF30B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd29.rbf

Path C:\Config.Msi\e5fbd29.rbf
Size 224KB
SHA256 be2885e897470da3778a661158dc21f32a4aada769996abda082cc4bb6030086
MD5 fda48714f6a291e25a1a219e89d59d9b
SHA1 c1e8ddfc64995c0acc48623f30aadb1448bca62f
SHA512 8508ee381bfc5d2491fdd9b14603003264441222984762d14f06440afbc2cc88d80b95bdbbec4089127ec76402408a60b850e1f46ebb5bcda5aa3ef1b6ce70ab
SSDEEP 6144:94pW38dqLQBu/UVCTI5ZwzCFNSLYBuvvRqHYt+T8pF5eLIlCXsxmzwdqf0JubPi8:94pW38dqLQBu/UVCTI5ZwzCFNSLYBuvK
TLSH
T18C24D541772A6031CA0DE37FCBBB06920771491719A2EF067AAD37E96B0215BCD87376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd2a.rbf

Path C:\Config.Msi\e5fbd2a.rbf
Size 1.6MB
SHA256 6f262bba82eed8a8d69fac44e491b99cca2d4cd448166291ce2186833e730a85
MD5 574d91266ee9fa03432cf50da30dd232
SHA1 b5c48a695fc376c174a79954a6d49280178eb4ae
SHA512 f052ec088a703e50c893decd7f88c0af2b36251dfc70b08e513d55964d1be299f0d772d52e71bf0aeb9abb752eda156767b8be321320e1c60f78af285b33aeaa
SSDEEP 49152:3hiMnQhSbc1O/YJaTE9WXARCLMl+vI5KD0tGHwByZAP0JC3g9O7sxa/4WVMTChIT:3hiMnQhSbc1O/YJaTE9WXARCLMl+vI5u
TLSH
T1E175B692B7498460CDE0DA7E79B3AF361BB8E02516F4DF0A3A0D76795E631858E01373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd2b.rbf

Path C:\Config.Msi\e5fbd2b.rbf
Size 898B
SHA256 17a9b9222850ce3e6786cedd7c698aa145453b37cf8f03d676fbd89f70afa072
MD5 846e77a9f3c6bb2ecf5518d470b2b908
SHA1 f16c73c5b7a4b0a596ab41472a246faffd9a9b01
SHA512 d94115b82c4abb4570a821919458fb2f322d939928fba6f00fedf139f489f358004de4db3b58b4fce05afcaabf7fcfe9e51c3cb7d0f6f43bebc56c2094086941
TLSH
T109115B1717EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B4190D89A2E90ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd2c.rbf

Path C:\Config.Msi\e5fbd2c.rbf
Size 11KB
SHA256 20e49d3119901517f055950021e922971cc65578c4ea2898593e29becafd2676
MD5 224d8b3ed1cc4f5b32e295612f1c263d
SHA1 d84f00249e43dcf21d4e68c1b2b21efed5f3c267
SHA512 87f9a1d17331e85a3df58fcd92e65a60f7b1a74eeac6c6707aea56fe7dde578f1b09798dc3f7a7c0a4b65696524793d7121b19d27902ecfc215a3233128dccd2
SSDEEP 192:3mGKX4WQcANHEWPn+sPJ9Nrs/nGfe4pBjS7/DPh:3lWQcANHEW17h0GftpBjG
TLSH
T19832DA5187FC9343ECF35E702AB6DE837D3DEB928D21562E009A915958937E4CE20B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd2d.rbf

Path C:\Config.Msi\e5fbd2d.rbf
Size 898B
SHA256 b3d09766f50b21e4b825d1ec7908cadc7fd74625b4757dc7952344797c72ac07
MD5 ec5a78ba8d91e89c0d9b3683d0cfd5d8
SHA1 0db33de0721fda2e302c39b98f3987ddb9267850
SHA512 c8ed1321211aa260ad8fa7314cc4036a743c0bc1ac06defc9d061edd4c3032f1e42c6cb06f2fa8836e66a0a4816a921961a5379b0e20ced8fd4f398085b125d9
TLSH
T1CD115E1717EC1304F1F65B14AA7914715BA6FC05AC29CDBE10B4190D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd2e.rbf

Path C:\Config.Msi\e5fbd2e.rbf
Size 11KB
SHA256 d4e738f4e3d39e7001830f71b52836a20707d14269cba22f34f3fdf0436981dd
MD5 7273fe5d0ce6473e646ba240e3fffc8e
SHA1 af11a7b48bde2b1046779147c84d3287a469639f
SHA512 9efc625c42ce99028297b23c78226264c851d74d84158c2221c2ff9faffd37248a3977461e9fc021e25b903bbc11ec475178157bf9fae9512bfe39eb98404a6b
SSDEEP 192:niZKXzW7HANcEWK+sNPbLrfs/nGfe4pBjS7nP5:nzW7HANcEWq/L0GftpBjuB
TLSH
T1BC32FB4187BCD713ECE35E7069A5DE837D3CABC28D11962A04AAD1991C97BE4CB20719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd2f.rbf

Path C:\Config.Msi\e5fbd2f.rbf
Size 898B
SHA256 e89e45dabc6a2422cd5f523d554d6314cf9ecec2238e26c6d8f63f040ed9b6c2
MD5 2408534b8cefaf5362700e8afedf070d
SHA1 f197be5f143eae025a5c40837b8432e89b8752a3
SHA512 94b78d6d0b597fe9b69d438f4ac3d0855ccc9c684a28070bb9e2cc44d171b5047b8c3da03406a05405c74ab56081dffbfe84478064b0b0884bfb6e415c3159fb
TLSH
T1CD115B1717EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B4190D89A2E90ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd30.rbf

Path C:\Config.Msi\e5fbd30.rbf
Size 11KB
SHA256 82a7761c6042176cf97947da1e910ce8a320fa7a17dadee2a115ac5f34cdc744
MD5 6d525c5be39dd69154fb0cf297fa9c1b
SHA1 48b89a8803b7020d7a0bc5dd760c261b2dbb87bf
SHA512 0a0416c8a7f967ea869ffe2fe77535cdfc9211d78fbff89e58cac0a4cbc38ba182fb3e88f4de3d38c010f6222ba52f8f10e3f58b4d13e5c7438f9a81a8f871ef
SSDEEP 192:xquIGKX+WtxANqEWy+sPJ9Nrs/nGfe4pBjS7nPueIrmt:xqyWtxANqEWO7h0GftpBjWGeIi
TLSH
T1AA32EA8187FC9303ECE75E7025B5DF837D3DAB829D11562A009AD2581C97BE4DF20716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd31.rbf

Path C:\Config.Msi\e5fbd31.rbf
Size 366KB
SHA256 c68b82408df6d0e6f7c7ca0a5e7d1c80af6cbec57788570bea58efff8053f306
MD5 d78266c35a0ed4bb6fb2f6683c8a6e68
SHA1 7ebda40cdb602b20323e6e7d24f28f25a931b11f
SHA512 e60ae6b2cd22614be134d06ce823bc5d31d0aaf1f01dcc4fd0f6021bd307609e8d2f47ebf8490d3bc33f0b225303b63e44f09384bc3804494f595e876e673854
SSDEEP 6144:v2TIVancZ+LgjL6hQP7UNG/wxSzMLtUj29QXSYS1g7u58fKdYOyRoH+lkBaZWHkC:v2TIVancZ+LgjL6hQP7UNG/wxSzMLtU6
TLSH
T1A084A605362E5024E95D6B3BC3EB0AA4037142136B66DF8275AD3BE58F422D7DD873B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd32.rbf

Path C:\Config.Msi\e5fbd32.rbf
Size 146KB
SHA256 a3334e83a418db4f304a621c2a498db48c0f8fe21f21282cc61e5ee9b80c1370
MD5 e8013aaa8fea097b88d7021039154ed9
SHA1 4866c788df4739c011e62f3634989e8959832730
SHA512 8614a03a87b2c06d1d2e577def16deea927e010d0f269f37613b9b737edf72350a5457b22a82d96ffd6d02747bf70116be301f891a0b103214ea3a8263cce32d
SSDEEP 1536:bD7h8afT+6ZlwKNRGIxO/00MLrnZRK0fRgNKaVCMGUBakxxBszmkLc819nh3fP5h:bvh1AuK0fWNKaVOUBakx4mkgEnNMS
TLSH
T148E39202FA18410AD9D9863D0CB76B50AF7DB24229F6EF0F998DB119DE033948D647B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd33.rbf

Path C:\Config.Msi\e5fbd33.rbf
Size 898B
SHA256 2ec5d00d46355af4cd7d06a00745e726b87c329d090e0acc02f767e75c60601b
MD5 4da7266720463186401b1ee9ae625e09
SHA1 040cf60bc1f52402d10e0b898e38b907dd9d9ba0
SHA512 da22f8e24f5d59232adf9e77914d65a82ec2bb1331a83f72c2d45f8e6e27de3bf113173ba56bcfa40e95851f105bfd941cf63392bd6d4fd4a9b1eba36087c091
TLSH
T1C1116D1717EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd34.rbf

Path C:\Config.Msi\e5fbd34.rbf
Size 11KB
SHA256 4d16c2bc77cc45c596dabbccf24e51b8d6b47c6582d540993856337d9c7dd6ea
MD5 91d3ae6b71705330e73ca4159817ff4e
SHA1 a941037aa373a426e73dfb853526f150ce4457b0
SHA512 8866140622e9241bbc2a5f7f26f659b7d2dcae7890c6ad357f76afeb5b96e6b30914b2b223906cd1f2b29eea27e885e33774782cd2c3b688aa1da72ee61a56f5
SSDEEP 192:PrcNKXNWQ/rNHfWft+sPJ9Nrs/nGfe4pBjS79cq:PwkWQ/rNHfWv7h0GftpBjQ
TLSH
T11032C88187FC9303ECE35E702AA5DF937D3DAB929D21562E0056D1981C977E4DE20B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd35.rbf

Path C:\Config.Msi\e5fbd35.rbf
Size 898B
SHA256 6aa7490ae4134caf546322c9aafdf062082536e1b4c8ed063c8bb5f93cab8afe
MD5 de2943783e864e16eb161a507dedcd3c
SHA1 577774c71730c72d22a80e5d049073fc23f8023a
SHA512 00abc7a380a864e808e2b0de3dfa5555b0bc691b0d8153bcf24935495b21722be21f9143edc67c7a0fe69f9e3d1e6ebb3fedd633efe439e6b58c1b5594c051ec
TLSH
T18D116D1717EC1304F1F65B14AAB914715BA6FC05AC29CEBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd36.rbf

Path C:\Config.Msi\e5fbd36.rbf
Size 11KB
SHA256 a19e7736666470a6eda6d00473cba753deb0e8fb40d3311daf3c50676040e200
MD5 da8a2cab1ddbd3fa6cfa43c0bff54348
SHA1 45268d28d4e628781f65f08612394ff7e0d38720
SHA512 18be388c509985137e34d4ccac72e60dd726f9c64b76e25988b7c91b3a306f1d15b21546face19ca087db02b0949306a554a889e3832a39c83f5f3686dbb5b10
SSDEEP 192:LvKXcW7UrNcfW0+sNPbLrfs/nGfe4pBjS7JcM:rW7UrNcfWY/L0GftpBjo
TLSH
T12632E94187FCD313ECE35E7026A5DE837D3DAB829D21962E049AD1592C937E4CE2072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd37.rbf

Path C:\Config.Msi\e5fbd37.rbf
Size 898B
SHA256 e2e634f5552e5214c79cdc2a33672f2cefda7c73fb6d9c7b87916130a969c4b8
MD5 5062f0598bc909a99bd21ff77d3421eb
SHA1 4917cf83d7e3ebac3fbf3e405c4dd633430cb98f
SHA512 ed1d812cdf867b963d0a9bebdb6d63698bb107409920ccdb770e197815f5d72b35cc8c1e3602d4b5c63adf06c0d9e125c5a5ad6eff2da22df373b06c7c88be2a
TLSH
T157116D1717EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd38.rbf

Path C:\Config.Msi\e5fbd38.rbf
Size 11KB
SHA256 705b42f6a55a4cecd347ba954089148572ba9fa033e5a08dba176b652488457d
MD5 4667b1d3fe384b97a94deb1553af2174
SHA1 e14902922748fffc1f65cb299b52c114887b761c
SHA512 3f2db08d7fbf8f6042f7ff1001f20df3879402a25e7d3b8bb7270ad3be7216ac07a8ded7cd62568d6292bcf3828286105e1d9b87f21dc3e1764d0bc20985a8bb
SSDEEP 192:pdKX3WtirNqfWL+sPJ9Nrs/nGfe4pBjS7xcpE:cWtirNqfWJ7h0GftpBjQEE
TLSH
T1C632E94187FC9303ECE35E7065A5DF837D3DEB928D25562E40AA91581CA7BE4CB20B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd39.rbf

Path C:\Config.Msi\e5fbd39.rbf
Size 54KB
SHA256 257b042bbab38406cb720fb9b2275828b003c6be15933227ceac68e08b846412
MD5 4f94bf5157da351f7d0089a0b72b1ad9
SHA1 c61d8fb8801a3362fcb8eb539003c996cd94e9fd
SHA512 f75d0365f67ff6632c8d1a3745e8e8eab55b25a562841910320dfda967a5428a5afc469a211e90d7ac78930fd55e0597b11aaf15cec5e57c0f22c02da53881d5
SSDEEP 768:cRaYO5keuEsW0dNMl0TMTHaK6W5LltR0Sbix8z:cRaY6keuEsW6XsHaK6WN36Sbqo
TLSH
T1F043C7767A6D6002E4690A75DBE29EC007BED9433053EB1BCF4C86460F93DA8C5C5AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd3a.rbf

Path C:\Config.Msi\e5fbd3a.rbf
Size 16KB
SHA256 883e42e3319fa4c059623e4d5a937215ad2f2cb123e88aaec27955f258627c4f
MD5 df0c6bb7965a3dfce5f0f158e9d5251f
SHA1 5250b2c7d557a71dc9fb0823fdc0cc94f0a81e35
SHA512 8b5f7cfb9d3d857b2396706cbcda445b9131abf79e84296ecbbffff0dc1588b19399b506e4e3110ac4782f60ddee081cd5243e598e0871738803512358efee04
SSDEEP 384:pUI2tn6TNZ99t5UWPGKPDW5MnC0GftpBjycW:utCr9vaSPiG
TLSH
T1AA723CABFB789142FCBA4A7422F5CD825D3CE7821D20971F5438944E2B42BD897507FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd3b.rbf

Path C:\Config.Msi\e5fbd3b.rbf
Size 902B
SHA256 4d997a3892a9fcee4bedb3f47b91f068d6ac823c5ee5f00d1887634e438f41c0
MD5 0da2f7810a668012c630db3fa8230499
SHA1 9ca963ea4e3544609741308d71863bc86a0c0ceb
SHA512 57e214fa9ea204094bed5086d6542a32774b3f234edd93d6f9eb364cb7a0825b2056bf2a299c65f8395545fe7f5e21869525575dbfa3c0b35c796f8de6c543ee
TLSH
T1B3116D1317EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B0194D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd3c.rbf

Path C:\Config.Msi\e5fbd3c.rbf
Size 11KB
SHA256 e485f4d3468410e989c147c9abeef742c57650a794e0ff18c2902eb976d25cc2
MD5 15caac1ec79f05d8aa62aaeec6903e8d
SHA1 1990604b5491cc83a73f592d1e70b41be5a2d998
SHA512 d418191828c8fca0a4d092d2101191fa5afdeff417cc4c9f1ba02795e3e4981a3ea3b0478c6abc00e284f95c5529a686411b90870569bfcbca15fba61372d402
SSDEEP 192:tuuQKXKWPwz/qXWf+sPJ9Nrs/nGfe4pBjSrpxQ:cZWPwz/qXWF7h0GftpBjGxQ
TLSH
T1AE32E84187FC9303ECE75E7166B1DE837D3DEBD28D20572E409A91991892BE4CA30B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd3d.rbf

Path C:\Config.Msi\e5fbd3d.rbf
Size 958KB
SHA256 b629ee28929ca972672c690ff25d7a80b4cab001a891de7ca310982a1149cfa5
MD5 a8c58bfc48a6a66459508607c3d2e055
SHA1 4821f3e5f60bab729bf20f412a13aebf6087c07c
SHA512 77639d5cdd2d74b9b3d7e0d77fea4a41157c09ecd741185ec6cf7c2399a6857342a39da143792bf5130c2f5b438ca3a3e1345accc8e820d7aad61073bd8f0dd4
SSDEEP 24576:1mPj0ZKH4lODcxSgo5Gn8WuMRIn+N3gN+zs5KPIVmkXiGzcJy3gt2LER6GvK9Hw4:1mb0ZKH4lODcxSgo5Gn8WuMRIn+N3gNt
TLSH
T18925C701335A6035DA5DC37BB3B32E5503B6A25B2D54EF06678E2E640F4328B9E4737A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd3e.rbf

Path C:\Config.Msi\e5fbd3e.rbf
Size 902B
SHA256 1c32d96764e57978c3b48beab245fea528fb2fbac7c657e76054eb9ef265e809
MD5 de893d3de067b8a1296ab5a79ec94c0a
SHA1 ea25bf0d30931efb54f40c080524d614345bf595
SHA512 900123bd81138fa32b9467d71a572ef21c5f7c054edb6d1edcf4395f4198086c7a336c48edbc837738192c2a90a0ea8abed4b96e39c6ee31abb1b969f3483b9c
TLSH
T198116D1317EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd3f.rbf

Path C:\Config.Msi\e5fbd3f.rbf
Size 11KB
SHA256 817846834678c94a7f0fd7b416313b9f86a075a6a042263f64ff2629a2370f36
MD5 7fcc238a67a82ae3362ba11b2fcaa42d
SHA1 47c427edfa0a0cad5b918dc35adc058a091def81
SHA512 422187e8479ed1c7c736d27bce68e8b7a05f4d755619152e6aa27ce042fefd6c10958c34e3ca0948ac4f4f41f7a042e42c087abac132dbe8cb8040ebec8d067c
SSDEEP 192:5uuobKXeWyAC/HyW7+sPJ9Nrs/nGfe4pBjSreiCq1:ABWyAC/HyWZ7h0GftpBjFiCq1
TLSH
T18C32D95187BC9203ECF75EB066A1DE837D3DEB928D21931E0099D2591897BE4CA30B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd40.rbf

Path C:\Config.Msi\e5fbd40.rbf
Size 902B
SHA256 c51167fc5983c55ce15cffc8283ed845307febf2bcb228f5a80f37c96e57c416
MD5 6190c8e68753ce68316109d87007ad10
SHA1 6a0fb3f829c5bd43e067b4ce443db0a54e52342b
SHA512 1db0b08f5f43c6460b83353651b95ef144753df7196be69d997fae71fc144084aea0afd9b8cf668dbe087762546ea1a5380bff92351e6869c1577b64bb09be0a
TLSH
T1A511611717EC1304F1F65B14AAB914715BA6FC05AC29CDBD10F0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd41.rbf

Path C:\Config.Msi\e5fbd41.rbf
Size 11KB
SHA256 b01c8271f3dfca8c9e5488fc401ff455165b91762b8ec04c8366d17f5d83fbbc
MD5 6b83627679d9828e23414534bd731fa1
SHA1 c7d7fe0fb457e1181902aea5a75c8a0c1059091c
SHA512 d2208ee88bcb8bd209651ecee01927463b1a22d11c61c5fc7078f6dde4b8bc499738702c2493621109faeb2672fcba0c93426065701481bc091e3e49be4a7fac
SSDEEP 192:Z5uu2KXyW5rC/cyWC+sPJ9Nrs/nGfe4pBjSrzrajcj2:K/W5rC/cyW+7h0GftpBjsricC
TLSH
T1E632F94187FC9203FCF75E702A61CE837E3DEB929D21572A409AD2591C52BE4DA30B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd42.rbf

Path C:\Config.Msi\e5fbd42.rbf
Size 902B
SHA256 22454fa6649bf945df4d5396225f712c8f8f9094bb02ab5484f80126f860472a
MD5 e38dff46977e5ee3696772f4659aaf7b
SHA1 a42304dfbd12a229700a1473a969f6cc2bd86a8a
SHA512 9e6ee5aa96ee30b03be7ed64dbf2c29d815de50af0330e0da99f510c31f409d68ac648059e9d6a31ed2532757eedd8e836af553d5b8123a2f1544be12b88cacc
TLSH
T10D116D1317EC1304F1F65B14AAB914715BA6FC05AC29CDBE10B0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd43.rbf

Path C:\Config.Msi\e5fbd43.rbf
Size 11KB
SHA256 1c0fb43d150a2b6e4073de17d6a1511f83bb19c9f54b0bd9ab374c4b5462bf72
MD5 2d4e556e6d5e74f48e7ca273c95194ce
SHA1 89e7d1eee8502f1f3fe82e8ab4073759c30effde
SHA512 ead4b728629b0a2b034944d09cf8c3dece9a21ce44fd5e70909668156b4536ddb2b4444555d98abe5058a7eff6562ede69c9dd7aacd6669e21c898c105959c2b
SSDEEP 192:ZSuuxKXuWPdC/qyWd+sPJ9Nrs/nGfe4pBjSrr8:Z9+WPdC/qyW37h0GftpBjM8
TLSH
T1F532E95187FC9203ECE35E7026B2DE837D3DEB929D21572E449AD1591892BE4CE30B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd44.rbf

Path C:\Config.Msi\e5fbd44.rbf
Size 25KB
SHA256 539d396ae31b46cc0e3e1cfb8aa2caa0a149d542fac7f94b0ba748855294afe6
MD5 6ccab17943576586bca7b5b3d76fce54
SHA1 4260c6af0d51d0ce0c51b21846098f71d6ea6386
SHA512 9c0521eb53bace029ad33e4c6734eb73562b835e25dffbe44c19c46e41b6c1ce92771de5402e55205f3aacfccbb6ec5b5af01011c25b73d773e98cf19bad435f
SSDEEP 384:js3xDR1LCmydn1ag+h9gKvMVXgPZwLRkTLUohUmWkGvKi7WSA/zB//0GftpBjYye:6xDR1LCmy113EdMV+F4iiy8ia
TLSH
T195C21905B229E036D4E61BB58FD353A90F34E6872D62CF1B144E62965F833C69D4633A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd45.rbf

Path C:\Config.Msi\e5fbd45.rbf
Size 916B
SHA256 71bc16e5fb250f3c5f8c8bbda53f6be35b2075437ceb21c5e931b1ca02f2294a
MD5 96fc5d4c006303a07c5effc8685d6cf0
SHA1 d029342db9c3d86c31846fbc587c823123581ba0
SHA512 be4818d11cf3d0fb10e4d0dad78b80a95a0084b55a53acbe7802f3580b3c0cf0788d3369aabd9d2645070a272df9a4191e3f19b879cd519901262cd22c74cf81
TLSH
T1A211611717EC1304F1F65B14AAB914715BB6FC05AC29CDBD10B0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd46.rbf

Path C:\Config.Msi\e5fbd46.rbf
Size 11KB
SHA256 a8d9243b5f6ea04b1c7fc178efafa93391aa7b471e13b6fb24ee6f7840a9abef
MD5 710a69bfce63c51cd374c865eecd6033
SHA1 25b4903f6021ee9c7c4a33071b6b9f74f8f8efa9
SHA512 6fd851035a5b843c50083317a789fa73ae4880e02678e6f9a1805d20e607c5a7b16876b8d42fa5032cd34626f7b257a56339ff1f4118e38cf3028ea841462025
SSDEEP 192:IO/AJCXQKX0Wf7QoH0Ws+sNPbLrfs/nGfe4pBjSD0qFXy:7OOqWf7QoH0Wg/L0GftpBjBr
TLSH
T11B320C41C7BCD303ECE35E713AA1DA837D3DEB924D21A21E0496D2591C97BE4CA3471A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd47.rbf

Path C:\Config.Msi\e5fbd47.rbf
Size 916B
SHA256 a54d627e90cc96d457405e92016fb1a1a5f7892883699cc6275a3d78828190b2
MD5 65467445f7fb846dcb6bd99e81318668
SHA1 ccf656f1a7296e54c2cca88cf948054869484fe1
SHA512 95910a21080f4dd416af8ae36eec412c3bb30cc30fc884064cb15151572a571518834d1c092048148a6bec908bea66fa9af6bc15bce4c818e1830014f838facb
TLSH
T1EC115E1717EC1304F1F65B14AAB914715BA6FC05AC29CDBD10B0190D89A2E90ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd48.rbf

Path C:\Config.Msi\e5fbd48.rbf
Size 11KB
SHA256 d03f38a1a142d0e4ee1b7bacb4a6ed5de5fd3396d3a62b295316f76d79cec8b9
MD5 af8d210f6efa97ea798639c865780209
SHA1 2f5aee66ae16afb5ede585a33508cb613f287f60
SHA512 b1a3ea834686c03385c0f814b7cd79a43f91e7a960169dea1d1be2759bd479c04a0abbf75cc6f6860ca3e68b6c56d47c45ac8aa0005359f9b8fe367f99a84b13
SSDEEP 192:nuy/AJCEKXcW0QQoc0Wvv+sNPbLrfs/nGfe4pBjSD9845:BOZW0QQoc0W3/L0GftpBjsv
TLSH
T17E32F94187BCD303ECE35E717AA5DA833D3DEB828D11925A14A6D3592C97BE4CF2071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd49.rbf

Path C:\Config.Msi\e5fbd49.rbf
Size 916B
SHA256 a64a013218d5d9b69deb76bff1aacd90c6375bfc9647e0092511fcb836b1a7e3
MD5 78c85ba5a1896787a2e90da630602d48
SHA1 9edf05e53f82a5f801328af7ac76c8e272efa853
SHA512 6082158dc59439f3afd23a070f13974d391540d92a28d86b8125834da3fd89df86828c543c2b798291c7bc3fefa39c2069e47c24878fc6c66cccedc81ed41dd5
TLSH
T1DD11611717EC1304F1F65B14AAB914715BB6FC05AC29CDBD10B0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd4a.rbf

Path C:\Config.Msi\e5fbd4a.rbf
Size 11KB
SHA256 afef4215369138f9a65832a7dfc607a4c304c090e8738d71cbe3b1b744713e79
MD5 1b2338684e5c800e290670b369ba5808
SHA1 7c344bff528bb89582aa15dd5972d09a7b87eb5d
SHA512 d9731c6d31786c05387082078df7afa6062653786afa65fa68e4a5efde51b1134524325cff644a1431cb93b2498e4e753eb6336a1adb235217b131c5ab1c8372
SSDEEP 192:n/AJC0KXDWCmQoq0We+sPJ9Nrs/nGfe4pBjSD1MCsq6:/OaWCmQoq0WS7h0GftpBjAMz1
TLSH
T18032E84187B89303ECE35E7129B5DB837D3DFB938D21961A409AD2581897BE4CE20B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd4b.rbf

Path C:\Config.Msi\e5fbd4b.rbf
Size 390KB
SHA256 51a234186dd5e1087a7ecb79bb8538767bd4bf46c645e1a6e83f972de726e95e
MD5 2cf01239384af6de8b712278d7598e90
SHA1 613cb264d8628008809878154f6eb17f35031c04
SHA512 0e2dc0cf2d2925895af2e5fb918f0c171bcabc6dfb8c094dd63ff7df535f776ff2c3ab89038ca5bbff0f4c02d8474055adfe3609c70d97870c46504f7bb871e6
SSDEEP 12288:n12bcBCHo9uz0pa/glmrMxyXYteDkZKPQq8lvmu4q51YScyjlyRnxM7x:n12bcBCHo9uz0pa/glmrMxyXYteDkZKS
TLSH
T1CF84F6163A0E8427DA9D077E857B8B54C3B2D1462A20DF07160F6168DFD33ABDE613B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd4c.rbf

Path C:\Config.Msi\e5fbd4c.rbf
Size 908B
SHA256 15cb74f02499b76c42faf72e6364392bfa997d0b2668016bec69dbd7d0571578
MD5 a9762e02d260a34b79fdea198f3e82d6
SHA1 5023fc4a74ce1eb15893cf0f724e658c9c5236eb
SHA512 61aba378b6a2533b9f67b4f46a2873fb08be4fe55c0de18785cd1720f4041aaf003ab0310a1d7415d8153508789ceaa82fd1b0731827f75aab41c5962c905502
TLSH
T1F6116D1317EC1304F1F65B14AAB914715FA6FC05AC29CDBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd4d.rbf

Path C:\Config.Msi\e5fbd4d.rbf
Size 11KB
SHA256 9ae57781418fef37b51dcbeabd4e26dd82a35c3aa2c15917cb98656889d3c7f3
MD5 af6ae18e360ffca6c0ceaeeebbf6d8d4
SHA1 0b4ee1121e9070e95147f6c1664f23a9c772ac7a
SHA512 eee57abce64bd9b1514a5a3a074948547725e78aba19e085b53d9e8156613a1ee30e60fef77429844ec4abd22ef02c45fe9f31aebff0eb7925e0a62e2b4efad0
SSDEEP 192:FETaKX6WD7c0HwWn+sPJ9Nrs/nGfe4pBjS7KsLTq:jWD7c0HwWN7h0GftpBjVc2
TLSH
T13E32EA4187B89303FCF75E7069B6DA837D39EB828D21572E00A5D2581C937E0DA34B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd4e.rbf

Path C:\Config.Msi\e5fbd4e.rbf
Size 908B
SHA256 742530e55d505236eae91ac26a923b2efa8b454fc0b449ba43f1d6a28ac5b52e
MD5 97cf058f86fa06f7e5893211dca28a42
SHA1 17bc3e8fdc48c24ca60d7b1ca10acdbfbd8b5e9f
SHA512 84df980720e846a8a3651d62f2639108818d18db139c6e0b41acb0ef4642312e11689bb6971ef778c1638d8d53430571eb8d560061e6e8c0cc13c1f40b35fcbb
TLSH
T1C2115B1717EC1304F1F65B14AAB914715FA6FC05AC29CEBE10B0190D89A2E50ACA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd4f.rbf

Path C:\Config.Msi\e5fbd4f.rbf
Size 11KB
SHA256 b40f265fe31c5dec0943b2d910e997ca1840ee290912b814eeab333af71fbd48
MD5 6a5ee23e3d7b67dfc39ce1c085d8c654
SHA1 6f9c0d88df3df2cf86cc543822b2e6196e849b15
SHA512 2d0cb3ada34426ec079933c96af4e3e67795cba52a6a78b520b7c7aa02a7e0eff53a33da206c7843df42a257474380b3014338c2063dc8848edbacbc6cadbbc9
SSDEEP 192:gTPKX+xWYQc0cwWr+s3LP0nWxs/nGfe4pBjSDiV4P/:uxWYQc0cwWFMnC0GftpBjZVu
TLSH
T1C932EA4187F89203FCE35E706AB5DE833D3DAFD28D11A21E4499D1591C977E4DE2072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd50.rbf

Path C:\Config.Msi\e5fbd50.rbf
Size 908B
SHA256 788f42981bf0bf25f0899d9e3c19a0d6edea44f9c1f9eb616160de99b82e8d27
MD5 9184814c35561939e4b0ad91788441f1
SHA1 a5281447d62fb3acb7915e757c68b6c29ae69adb
SHA512 cdd744fa29b63922cb112d645badfe59176bed7a5c2ec12e3e8d095ca2401588565f356aea4a1f40157434fd8d20edbcfc92febc4fc33e4a13a20abcd38ed199
TLSH
T134116D1317EC1304F1F65B14AAB914715FA6FC05AC29CDBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd51.rbf

Path C:\Config.Msi\e5fbd51.rbf
Size 11KB
SHA256 a4d8b8a525271bfa836744b7705f0993ab454d9a153f81b3502cc62d9284dbfc
MD5 acfd9dff068c374658366e397a5695d4
SHA1 bbd33c62b022d3592e0c2a67144070ff4e2709a8
SHA512 b2ca941ee0d18bec576ba84e09403cd8dce41b9017134581f1a2e2babe25dff99e9f172a6e9764ca6c58d5ac679405883640e2b7bd108cc0308336098d9099ae
SSDEEP 192:z+5tTpKX0Wumc0qwWC+sPJ9Nrs/nGfe4pBjS7KBfYl:a5Wumc0qwW+7h0GftpBj5BAl
TLSH
T14332EA4187F89203FCE75E706AB5DF837D3CEBD28D21921A40A591591C97BE4DA20B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd52.rbf

Path C:\Config.Msi\e5fbd52.rbf
Size 19KB
SHA256 6131d4341986952f7343eeb984544a17bb5f121e1b24ad572ae93d928f9179fe
MD5 f8354171db5fc4506cd0a0b9a3c9eaf6
SHA1 f155f11010d91896161a2818815a1dc32f183731
SHA512 10aa970372b956ee7d018b4d5d8bd7faedaef20b83ada551e7a260730d5a642c9ea13548743ebd470f5ecbc7a08ddead828c41e229c96538d93d3f0ea7cea52b
SSDEEP 384:k7EBsijSogvgWI9psuWaGDum7WA/L0GftpBjZn2:kIOiOoggZSimIiL2
TLSH
T1C1920972F66DE207ECCD0F7512A89A519E35A3436A11EB5B84ACD28E4D837C84F1463F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd53.rbf

Path C:\Config.Msi\e5fbd53.rbf
Size 904B
SHA256 071549c2a67ba11cb90362c3a60b904e339c66d33add4e0fdaf348f17365695a
MD5 967be7e7a5e3cfc4902a4dcd26eda18a
SHA1 f0b364113ccd380a256a3f6217b8795300d0fe30
SHA512 db437ef46aae9b0f45bd21958397c163f2c55c85bda25215af041023c63531ae3e0b62fec62ba76b70c6a297b928fb7c8a79ce82463ade93d22a6501b756ccda
TLSH
T10511615317EC1304F1F65B14AAB914715BA6FC05AC29CDBD10B0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd54.rbf

Path C:\Config.Msi\e5fbd54.rbf
Size 11KB
SHA256 c1fb9faa66ac74fd4094538d83afa96c8c3a5bf7f30ec302b7ed1ad1f4d99b25
MD5 e9e2502356902589e8b0b86314294f30
SHA1 44a972c0ccbd52ac6e21f2c0cc1dc81907b5e7dd
SHA512 7e51bd97735028dd90e855d8e661e2aa8c9e859e2b4c02475d65ba67eab8cd99ce207795e9a6eb4b146483852bd90255feaabc7b50534a7efc43bbfdfdcc2849
SSDEEP 192:Xei2KXrWBBcyHwW2H+sNPbLrfs/nGfe4pBjSDTSgb0:O6WBBcyHwW2X/L0GftpBjorb0
TLSH
T14732F941C7BCA313ECF75F716665CA837D3DEB838D21922A04E6D15918937E4CB24B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd55.rbf

Path C:\Config.Msi\e5fbd55.rbf
Size 904B
SHA256 9d4041b781a2fe7e677cbbb210497abce1c6e566047fe4592d6b2bd182768c43
MD5 8a138a7c5f6826e2adec47162589bdc7
SHA1 8ba9043cc728827655406126e46950e6a6bf35a1
SHA512 beb99a0c999a2e2b3bee93c32246826608d74c95b4aa1e5993228dc5af9e1a775035f52bacbd488d7589f9821fe17df2652f94bc5b66297963fc3f6062b8e0fe
TLSH
T1DC11615717EC1304F1F65B14AA7914715BA6FC05AC29CDBD10B0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd56.rbf

Path C:\Config.Msi\e5fbd56.rbf
Size 11KB
SHA256 fe61442089ed613075613d0db818e9f1c87907dd5c76dbfa67e93abf7f24e135
MD5 aef35350473c3e263b6d8d4a76616b7d
SHA1 265bf8cadf460109a3a2d0d8e23b7b1eb18d7660
SHA512 b4f966b9c921364283a6dc42d8b44ec10e8d032089dc157c23ecfda55fbb16f86b9c02cbb22fa0eee51dc784ed83876c9b29ee9cb1cbe823e3b99bf08e46cd76
SSDEEP 192:U78MKXzW66cycwW7+sPJ9Nrs/nGfe4pBjSD8wXHNok:UiW66cycwWZ7h0GftpBjfoOk
TLSH
T1B032EA4187FC9303ECF35F7026B1CE837D3DEB929D21921A0499D2591CA3BE4DA24B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd57.rbf

Path C:\Config.Msi\e5fbd57.rbf
Size 904B
SHA256 8d0b449684a977a3d81b8fad0663a20555504e8609c987e84364a6e232b51356
MD5 a5c7d3197e0ac097600d2901ed4f6e77
SHA1 a459c50978c7e377f1130d7779f4a2fa41d0033c
SHA512 f9d662be82e96ff035c7aa938a9de7f47162bd4564575eed4aaa42ed4ef49ced0fa4a9b6b2b789b5655c3ac6787f7b3c8439d82962d9668c1d31e62a54a804bc
TLSH
T1E111615317EC1304F1F65B14AA7914715BA6FC05AC29CDBD10B0190D89A2E90ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd58.rbf

Path C:\Config.Msi\e5fbd58.rbf
Size 11KB
SHA256 51063c0b520a9ab73aa3a0674c593c3c3de26fa9709175be085d2d8c456ab54f
MD5 8b1132f4e0387a233497141cf30b1edf
SHA1 2afb866bc5093b1281b2ad0fc4a29bc2cab035d5
SHA512 f528da8cd45823fadecf870a348f605e8fa199c6bb139c7930392cf638289c794ea15746cb0f4b9d918a1fcfae7c6578261e7c20fced854e9afa20974e252490
SSDEEP 192:0bLGKXtWsscyqwWF+sPJ9Nrs/nGfe4pBjSDgVsJ:sWsscyqwWf7h0GftpBjXVsJ
TLSH
T1C432E94187BC9303FCF75E716AB5DB837D3DEB828D21961A0499D15C18967E4CE30B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd59.rbf

Path C:\Config.Msi\e5fbd59.rbf
Size 918KB
SHA256 66d6f247e3cae875c3c86dd16ea1aa3512663b8aa8626984007bf5343326bbaa
MD5 be6f4fd7365dfa124d60114095380602
SHA1 66a41958ead9151d7e61d690f12006ca8a40df89
SHA512 e9f7d819714c905577a2603aa30cc72b87b7a66561c7cc6029dedf48de78fc3db580069602dedbc6b18496217da6b94bbe0c2734ba2dfa5f8b57b7fc6cbdb781
SSDEEP 24576:HccGtk7SB7EhKP4F+j85iXQ9WLTeZcnytg7WR0vCYByTsVGHw5qbEtevIRiDcl2r:HccGtk7SB7EhKP4F+j85iXQ9WLTeZcnw
TLSH
T14415D612332D8025DF4DC77EB597AF1247B1E1051AA0DF1A6A5C26B89F8368ACD423FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd5a.rbf

Path C:\Config.Msi\e5fbd5a.rbf
Size 896B
SHA256 89547b37ec7e20f96e1f1b9aeabbe86cac8a0372bf1520fbc2272eed16f8b4a0
MD5 070f18d93af687edf010efa343dcc983
SHA1 16858f9fd0d8ed788ec49460ca2b596c193d2af1
SHA512 e7b9ca446b5ebf397e7c220e8a0f639ce20fb35a11010b641f6727ec1c9119093790d4f5521ebb28e8f6de4ed5c4c4f58a27355fb5d012ec949f0de3df5586de
TLSH
T1FD116D1317EC1304F1F65F14AAB914715BA6FC05AC29CDBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd5b.rbf

Path C:\Config.Msi\e5fbd5b.rbf
Size 11KB
SHA256 6555b4dd2c4e4164c8e00c06f6108a9c1dcdf141a5ca54bbe5675e08750f63b4
MD5 a06591a7b689e5fe00f6755a180af130
SHA1 a581485fe2c6d9acf795e80c7d6b0f3a0e721584
SHA512 bc0195276fa8c7937c7c39d567a7f41cc4ef92521836515c11ef5b422d68aa791b96fed829900e998435eb5b719c3a21e58c94534ec1fe4d637e39d43407e4ff
SSDEEP 192:aA8CvKXjWdIdWHlWV+sNPbLrfs/nGfe4pBjSzdd4khW:aXCAWdIdWHlWp/L0GftpBjkd4ks
TLSH
T1A132D98187FC9303FCF75E7176B5CA837D3DAB829D21921E04A5D2591C937E4CA2472A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd5c.rbf

Path C:\Config.Msi\e5fbd5c.rbf
Size 896B
SHA256 aca44b663633d4785d4fca1ed45d2c1d58c994fd927374569b8b5bfcd7079170
MD5 9f8ecff52bd15cff2deeb91bd325e101
SHA1 c82a0eddc66f95f0bfe1fc984671837cf0b07a65
SHA512 cf52103d480a589e88c909239dacf5add2467adf6f4ad52d89af16ffb9a5cb32d7e771fe005694d37189ab2ecac08cad9ca7cbcc7d971f17d384a959705f168c
TLSH
T1BC116D1717EC1304F1F65F14AAB914715BA6FC05AC29CEBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd5d.rbf

Path C:\Config.Msi\e5fbd5d.rbf
Size 11KB
SHA256 dde3ccb81cfcc3eb4cc65752fe14bf0c7ffc6814d55f7c9bca4d9ae638b30f6d
MD5 90891a2ac9ef19d26ddfae3dcb69fadc
SHA1 14af0ba5b5b4ed5dd82685c7e50a544a5c5e7a98
SHA512 4f97ab143a719bd614a63a3b34bb6ab6931eedf310e2e077c361fd63d2d579e126a3a419256834b021d86250114ecf4c0ef120c9fb267be9aea004b252c17a49
SSDEEP 192:D8MuKX3VWWzdWclWQ+sPJ9Nrs/nGfe4pBjSzJOY:AM7VWWzdWclWw7h0GftpBjUOY
TLSH
T1B732C88187FC9343FCF75E706662DE837D3DEB929D20522A0099D2591C92BE0DE30B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd5e.rbf

Path C:\Config.Msi\e5fbd5e.rbf
Size 896B
SHA256 e709b2b5901d6987b46febd4f3d5ba50b94e4ae4e0a6bde09ec981509b72000c
MD5 f1e8d3b056eb17b33d6d23b5dd20eb56
SHA1 7556e1bf214dca70ffec24768f3c549ab4ab1886
SHA512 914b340a8c175dfed4cdb99bf071e14ab787481517009ad92680725368dd7b7667dfe2ffcfbaa871b2a9edad6b8566828133dccbd0a0c7fb90cbabe4f812da87
TLSH
T104116D1317EC1304F1F65F14AAB914715BA6FC05AC29CDBE10B0190D89A2E50ECA2FFB
MD5 SHA1 SHA512 TLSH

Submit Download

e5fbd5f.rbf

Path C:\Config.Msi\e5fbd5f.rbf
Size 11KB
SHA256 4e5cd2074b70b073ff9010a22f6e469fc08c93f63e14c85de93377c2d0e97fe3
MD5 3fd311d5a5cab694d93c6de5ab39adc6
SHA1 2950e2cecaa45f46dcc443037c7a4db550533578
SHA512 fd884db714d134994c1ef742ee85d5002b07e29b8bf1db2120a4139198f162ad67b093be3f232eeff3e05976ad243ef691af69db86ebcc8e2d6f0400245c6a35
SSDEEP 192:C84AKXNWAldWqlW1+sNPbLrfs/nGfe4pBjSzy+t:h4LWAldWqlWJ/L0GftpBj/2
TLSH
T1A732FA4187FC9313FCF75E7066B5DE837D3DBB928D20962A0496D1591C93BE0CA20B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd60.rbf

Path C:\Config.Msi\e5fbd60.rbf
Size 44KB
SHA256 b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e
MD5 bc959a160882b0de0583047b1b5b93a6
SHA1 78bda837a0fcc25623b54e95f3eff76c3bd79332
SHA512 7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd
SSDEEP 384:sA4dzYZj6Tt3jmpuXkGtrfK76lNWg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+7n3n:sHK6TtMGgpFiJi3SYDw
TLSH
T11013541C97E70712F2B34A719AF150C24ABEBD03BEE6E77F9B45030944616884992FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd61.rbf

Path C:\Config.Msi\e5fbd61.rbf
Size 41KB
SHA256 4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806
MD5 91ceea551937cb5da627f33ef7995ee8
SHA1 4e7483605c4027381e4796345f0a0e6aa9342a5b
SHA512 2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9
SSDEEP 384:XKBk39BmxOVst4SCtrpuXYa1pbr/0K7yKKJ9Yu6dnPU3SERztmCJMadMardz/Jiq:XKGfZs5CZqljU6rqnuqzeEfViIF
TLSH
T1FC13B529D3F84712D2F74BB16CF1A4835936FA539EB8DB5C149A530A48133D84E62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd62.rbf

Path C:\Config.Msi\e5fbd62.rbf
Size 76KB
SHA256 972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867
MD5 7173d17aa9ff4cda07fbfff21a584a67
SHA1 37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc
SHA512 b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167
SSDEEP 768:MTcr9yq2UX/RPLYyODdyoSNjSvYomC+L8XW/FuhyINGLTGnBEPzfsTKJzePDFiJg:9dVV8XW/FipNGfGBEPz0ceceimOU
TLSH
T1AD7385189BFD0722F2B30B71EEB684C15E7FBE277912D61F5508414E2491FA488E2B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd63.rbf

Path C:\Config.Msi\e5fbd63.rbf
Size 35KB
SHA256 06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39
MD5 da7787ae5278031ef79441d29599dcff
SHA1 4e2a4c70035808dd8bffaeb6ded8fe2980566e0f
SHA512 2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e
SSDEEP 384:neght+fMtSM9jmxa1CFbfKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3hW8zNWZQ:egX+EtkqR6rqnGHKoVijm
TLSH
T181F29529D7F84712E2F347B1ACF684836976FA13AE78DB5C14C6534948137844A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd64.rbf

Path C:\Config.Msi\e5fbd64.rbf
Size 35KB
SHA256 b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa
MD5 86a1d818b679edbe94ab51b963ba79a1
SHA1 2b9ee6b54aa2f709442e7e514335e2548c933318
SHA512 ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9
SSDEEP 384:6kQOJrYa7mdessomj5R/yeizfa19xrwKJ9Yu6dnPU3SERztmCJMadMardz/JikPg:tQOVYoxVUqzD6rqnz7AWpLrFVieG
TLSH
T1E2F2C628C3FC8326EAB34B70E9F594876937F513AE76C7AC1499530D08227944523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd65.rbf

Path C:\Config.Msi\e5fbd65.rbf
Size 21KB
SHA256 0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956
MD5 6083b2909a6c1ab52ce84da1b435e7cf
SHA1 e851ccddf1fcb0c2fd9cfb4a357f72633452f240
SHA512 53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1
SSDEEP 384:WK2RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYW:TurKjgEnGEFiJrvPA
TLSH
T1C6A22628D3F85721F2F34B70ADF284839973B913AE79D76D2586030D0866A449963F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd66.rbf

Path C:\Config.Msi\e5fbd66.rbf
Size 24KB
SHA256 4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb
MD5 d87310699e3baac5ecc0f64673fe3485
SHA1 34460b0eb74977b98d9d3e683d5ffa2aec11059c
SHA512 096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38
SSDEEP 384:CZp0wdaXOa1FOKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81LUWIYj3gWUXRm05:Cz0Ka+qb6rqnDnOVi+t+8
TLSH
T152B22428D3F85312E2F38BB1DDF58487A976BA53AE35C79C2596134D08227844963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd67.rbf

Path C:\Config.Msi\e5fbd67.rbf
Size 280KB
SHA256 a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b
MD5 a3ae8e892e025e479978fb07fb449784
SHA1 71a1641ffb0da859af5e355c5bf4a9bcf1746e74
SHA512 e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54
SSDEEP 6144:Z/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvd:+777376V7777U77aPMKIXaXce7mNTp8Z
TLSH
T19A54F8A6A2E84F22D3FE037920F1554B09F1EC17D64EFB4B684082F56C1B7A09A63D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd68.rbf

Path C:\Config.Msi\e5fbd68.rbf
Size 108KB
SHA256 6e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6
MD5 1c8e5ef9f86430fbda800e45c0a89aa5
SHA1 4e18ee249a208dbf7d7b52d412fa0d402fd3ff2a
SHA512 721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66
SSDEEP 1536:64OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQns:6rjoi6vdu0Ow6tKGfU+IN93s
TLSH
T1D2B31A1093FC4721E6F70BB57DF6A0418673F9229EA3D31D1959060E1826F948EA2B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd69.rbf

Path C:\Config.Msi\e5fbd69.rbf
Size 152KB
SHA256 a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036
MD5 6742f826c21773c933fc2a68ceecb99b
SHA1 dc689d3fb31e7cab6a33cd2192d6114542173514
SHA512 4138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a
SSDEEP 3072:Z0anyn/CiBk6HOIz42IJqFF/0/WAWwerjeVPt:Hn+Va4k
TLSH
T12CE3295A63EC0716F6FB0731A8FA54416EBAF8032966CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd6a.rbf

Path C:\Config.Msi\e5fbd6a.rbf
Size 140KB
SHA256 35cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a
MD5 cad14a2ced4a556139097c1f716eae70
SHA1 9552115b645c17165bacc2231725b3f8073105a3
SHA512 df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331
SSDEEP 3072:wAyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcj:wrIMFRuf
TLSH
T1FAE3281963E81B1BF2F70734E8FB00824BBAB9077967D71F694E41CE05A1B844662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd6b.rbf

Path C:\Config.Msi\e5fbd6b.rbf
Size 189KB
SHA256 f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57
MD5 1f50737bb92b1f71b15824a0f113d3f9
SHA1 4d78793ea921986d011a024b91ac59d6c02de6e0
SHA512 89e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4
SSDEEP 3072:Lcs+QnXsia21rUBJeImxRGluQriZy+GZ7X/kMIJo:LcsrRIHiYYK
TLSH
T1CA14192467FC1B11F2FB4B7AEDB5A0019A76FE662D13D31D15A0419E1872B40CAB2B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd6c.rbf

Path C:\Config.Msi\e5fbd6c.rbf
Size 76KB
SHA256 dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361
MD5 d68368708be2b6dac797743e23dbf655
SHA1 e843b858d72359ecf6fcdfca328ed19a7f23210b
SHA512 2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e
SSDEEP 768:nI/327083Js1D8z1bKta9mqfVD20avQwiubnW2yCzT/8yA:nI/320UJsbta0qhRwfLyCzj8yA
TLSH
T17973F700BBBD4BA9D1FA0B7AA8B990109471FE557813CA1E0E94B14E54F2F90CEB1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd6d.rbf

Path C:\Config.Msi\e5fbd6d.rbf
Size 428KB
SHA256 13f36534cf603cd722ac9078e51930cba190395d23d6688b65a8c788262759e5
MD5 9e877ffed2e2c9a013c59581f88786b5
SHA1 d3bbb3e2c36520ec267463916d3356bf4fcd8037
SHA512 5b4ff6de141bf2dc321dfa05fe8c93f64ca91eae6b41041264736c3c6db9d0520c135103873c5f32a47c742fb51317b3303e7656cd259331113f9b876ad17613
SSDEEP 6144:7Nu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJP:Zu/UT4HQ+hpxK1/
TLSH
T1CE94E71023A88E2ACECB0275E45BC6158674DB0A76ADEF5F5DF5E2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd6e.rbf

Path C:\Config.Msi\e5fbd6e.rbf
Size 292KB
SHA256 d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c
MD5 bc9a83d77cae33f9eb9bd538ab65b2a1
SHA1 363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8
SHA512 37ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57
SSDEEP 6144:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfM:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvZ
TLSH
T18B54F816277C4A2FDA6B0674F5B2067106B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd6f.rbf

Path C:\Config.Msi\e5fbd6f.rbf
Size 128KB
SHA256 c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef
MD5 c7fc5f01de9577403a1ea8aafad79e72
SHA1 6422fa355184394ace02c0ba88e5b8af3db7fa6c
SHA512 b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87
SSDEEP 3072:HEmV8EKUaX1IrJeE+6pwluGCulHxTqo+Ue:HEm5azUaxW
TLSH
T126D31A01B7FD372AF2FB0B79A9F96001C97AFC556A26D78D1851424E04B5F808A72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd70.rbf

Path C:\Config.Msi\e5fbd70.rbf
Size 92KB
SHA256 6e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5
MD5 535d9d8441e0e22aa3f407c7197f8a0f
SHA1 ec6d047e975c107a7ecdf78bf352a5a68f53392f
SHA512 f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e
SSDEEP 1536:KJr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016:KJi6vPUL7zxwXmh8Gf99XZ
TLSH
T1CA93E82493FC4F61E6F71B742DF6A1814A72F9625EA2DB1F102D410E1D23B948972B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd71.rbf

Path C:\Config.Msi\e5fbd71.rbf
Size 356KB
SHA256 8186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090
MD5 5e1a793d9615d4d9e153ee416abc83ad
SHA1 27d231f4d1e2b473f9695daa21b22804db779826
SHA512 f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876
SSDEEP 3072:JBijFKiOKL/u3RW1NvAbugFh/jLqthte2Seh6GVa5DU91Tp01sq9kAaCXrmRKHpH:jIZrvgQKA91TnAa+tPvH
TLSH
T1B774C62073F95208E6B70B30AC7651C51A77BE67BE15C62F2449324D6A72B938B23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd72.rbf

Path C:\Config.Msi\e5fbd72.rbf
Size 352KB
SHA256 8da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296
MD5 03898441f5d9a8809c04fe746fd498b3
SHA1 35cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6
SHA512 dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12
SSDEEP 3072:DAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Ex:DAikDFsY3IYU+uojT/xK6ur6EaPef
TLSH
T1D174C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610E1871B819A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd73.rbf

Path C:\Config.Msi\e5fbd73.rbf
Size 82KB
SHA256 33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a
MD5 f148286b321ed09c2d17e9e3637c807b
SHA1 b0928429f52028b512dad9c7e0996ee7ade315d3
SHA512 d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b
SSDEEP 1536:mkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79WShdMUVV:mk3gCbzexZG0YUBXfqidZhdM4V
TLSH
T155836B17A3EC4B13D3F64630A8F09A03AA71FAC37566D79B30466769089B3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd74.rbf

Path C:\Config.Msi\e5fbd74.rbf
Size 41KB
SHA256 27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db
MD5 e3c8239a97601bb203b9e9037eed89c2
SHA1 75f0e5f417477d4c491e8ad81f498faf761618a1
SHA512 71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2
SSDEEP 768:Jc1JB9Xaefxf2ZquXoQGaHQ6rqnig3qTVi:O1JHXtp+ZquHHwig6TV
TLSH
T1FC13D72493F80323E6F347B09DF194839A37B953AE25DB9D1099574D0812BC5CE62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd75.rbf

Path C:\Config.Msi\e5fbd75.rbf
Size 76KB
SHA256 e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457
MD5 219c69df0c23fdaf84e4c9ea2835a628
SHA1 d3b091bfcaa8506d299cb1d7453fdce7fb27dafe
SHA512 e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8
SSDEEP 1536:SdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHN2gxyVu8:4YR63P8dlNGu1IcT7TXLqbgx69
TLSH
T1B373291193F88327C6FE43B564F0A8125FB9F653BEB6E71D0885939A48537C08D52B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd76.rbf

Path C:\Config.Msi\e5fbd76.rbf
Size 80KB
SHA256 5a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d
MD5 75e8bc00ad7da1e7628f146dc33cc83a
SHA1 b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e
SHA512 b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3
SSDEEP 1536:4Uy56bAm4HNNN5AU+QO2TFvKe/elIQcmEtli/G//ZgUKtmOo:Iu4HNNNmdy9EUIG/qlY1
TLSH
T1B8831A1993EA4B13D2FA0B7898F154C24BBAF5037DB6E72F9A46124E04933C44962F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd77.rbf

Path C:\Config.Msi\e5fbd77.rbf
Size 48KB
SHA256 e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f
MD5 775dac5f81248b14182c82013672c42e
SHA1 cef7bba712b25da04f60f597cb614c7e4b87f24e
SHA512 2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c
SSDEEP 384:Qeg/3V8jOAfSr7CgWzwL4/7y24p4kwo6972IbL8J717lw2Ghr49gpWg67KGhJSxl:V6l8HKAMs/+24E7r8LVGUFiJzFDQ
TLSH
T15323321C9BE75323F1B64A71EEF145C24EBDB803B9A6A73FDB451608089368844D2F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd78.rbf

Path C:\Config.Msi\e5fbd78.rbf
Size 24KB
SHA256 db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236
MD5 2a9b706d83be29f32a28f29be397e533
SHA1 31135de80dd7b7c4a27516806fbbb13d871548d9
SHA512 cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64
SSDEEP 384:w3K6a/IZa1nKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CmWbzpWZDzDm0GftpB/:w33qA6rqnLPAVip
TLSH
T1ABB20428D3F85312E2B38BB09DF5C487A977BA53AE39D79C1496134D08267C44963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd79.rbf

Path C:\Config.Msi\e5fbd79.rbf
Size 36KB
SHA256 f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b
MD5 bd3e2c28c647533a057b5cdf8bff2c5f
SHA1 d36c80e460c5dde615ab1c268bd89309225ecb82
SHA512 14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc
SSDEEP 384:NQK7QQZbXvJ5qCmIG7g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+G6reVxW8H7W:JbxjG7FiJH6a1
TLSH
T103F2AF1C8AE70652F1B24F70DAF140C25EBEBC137DA6676FDB4607090C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd7a.rbf

Path C:\Config.Msi\e5fbd7a.rbf
Size 52KB
SHA256 9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4
MD5 63a1e9cde10490008ba7ef47a12179d1
SHA1 5299af182b7cf08f95fcb3815149d7c54e73187d
SHA512 dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe
SSDEEP 1536:oy8H8QhPyUv8whq+927kgF1fGguNnJKIZ6:fZT1fGfnJrU
TLSH
T10F33C81897EA4722D3F70B7198F245C24EB5F803BA77E79F0A4853491C52B848D92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd7b.rbf

Path C:\Config.Msi\e5fbd7b.rbf
Size 36KB
SHA256 19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b
MD5 7a016cec8851a57b2f0376ae6d1fc837
SHA1 f161f9d8d7b073c1f17f55719c37124969bd7d2a
SHA512 f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456
SSDEEP 384:Q5Qndl5IG9g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+GwE/778UWj3CW:eG9FiJHF/cJ
TLSH
T187F2BC1C8AE70752F1B24B70DAF140C25EBDBD13BDA6A76FDB4507080C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd7c.rbf

Path C:\Config.Msi\e5fbd7c.rbf
Size 64KB
SHA256 0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7
MD5 4d4774a30da56119888490cdf3157b09
SHA1 360221725daa9b7a14460fe6939d54b2173fb8d1
SHA512 eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130
SSDEEP 1536:9pvk2mCtNGNMGfRfESSgOX55uKG/SmawWQie:XkEGfR8SSgOX55uKG/SmaTE
TLSH
T10353B508C3AD8322E3F607316DF186825E71F5437A39EFBE0946375508AB7C46562BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd7d.rbf

Path C:\Config.Msi\e5fbd7d.rbf
Size 62KB
SHA256 c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1
MD5 9002a577c07ab2b99979435cd8b67acd
SHA1 5b3c6231c113b726ddd55fd8a8e3ae84b1526820
SHA512 f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47
SSDEEP 768:mdgc7HHzMKqYyb6FZZ3JEMTt924zM8X79qZI336rqnbsWraHngVinE2:fc7HHzMKpyGZ3Jr249XJqZqtbkAVQR
TLSH
T1E2530814D3F88723C2FB87B568F148839A76F743ADB9DB5C1486532A04577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd7e.rbf

Path C:\Config.Msi\e5fbd7e.rbf
Size 61KB
SHA256 241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec
MD5 218e31b07c6e07633a84f0248730e220
SHA1 47ee36529b741f3d52c487e6dad151f516c2eb5a
SHA512 e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0
SSDEEP 1536:ran8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsNjNPBDWGVb:NMPG7wqhDW+b
TLSH
T151532918D3F84323D6FF87B8B9F195435A36F843AE62CBAD188A538905533D44913B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd7f.rbf

Path C:\Config.Msi\e5fbd7f.rbf
Size 81KB
SHA256 ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650
MD5 93030b5af327ece3ddc3518410e1af59
SHA1 4be27729a906169d2afcf025e10f308fce35056c
SHA512 247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d
SSDEEP 768:PVQ+jyq2UX/RPLYyODdyoSNjSvYomC+L8XW/By/g6I+wVtB4dmg1ZqnBEPzmhK7x:S4VV8XW/Og9NCJ7qBEPzmW2yZAW7KVg
TLSH
T1E6830955C7FC4726D6B74B70F9F78446A633F967AE23C78D1408824E2851BA484E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd80.rbf

Path C:\Config.Msi\e5fbd80.rbf
Size 200KB
SHA256 ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8
MD5 c30dfa5fbf9f2e6d18ceb7108923fdfc
SHA1 523c4b9043cd6d722c01215f64173b9287623d76
SHA512 075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2
SSDEEP 3072:20ZVVxFlfJ57iPki4i14IBkb2/Demjzk27wxqWSDsKnFp6/M/CP15rFJgStL+L:t5Pu4M4IulbK3C6
TLSH
T1D0144B1663FC4726F6BB0B35D8FB11026E7AF9172967DB1C2889068E0971B809973737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd81.rbf

Path C:\Config.Msi\e5fbd81.rbf
Size 197KB
SHA256 19e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501
MD5 fca2f9f00de26d0b5af4881836d6337a
SHA1 b11dcad7c00c2c85354b131c796ae34bbbefdb38
SHA512 7fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738
SSDEEP 3072:/rFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirW+Y/43zNFk1C:/rFAoOXcHfIfiA+/
TLSH
T100142A14A7FD1B25F2FB4F79EDF6A0018A36FA262D23D71D15A0015E1876B40CA62B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd82.rbf

Path C:\Config.Msi\e5fbd82.rbf
Size 27KB
SHA256 db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57
MD5 aa8ef0154efa83de1c2786ab1cb76f37
SHA1 5e4fcdf55c34538dfdda172a985731019f74898f
SHA512 17d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd
SSDEEP 384:eZPbNawkFSvPSN4J3DztyJbDr3Zcv+qLrVAtJCl9F1WijgW1Qim0GftpBjF9ZE:eHaVFSvPSNEtyJvrpcB9qi/bfVizTE
TLSH
T170D21A00C7FC536BE9A70A717DE59981493BFF52AD23E21F4068C05E14E9BF48A66723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd83.rbf

Path C:\Config.Msi\e5fbd83.rbf
Size 15KB
SHA256 1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099
MD5 62faa6fe395c5810fe4fceffcba62966
SHA1 ed830d3d1156c3a5ea6502148f4347af0c4a8051
SHA512 4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54
SSDEEP 384:21LtwmrH+mFqmwW/zwWUQim0GftpBj6XY:21lFpGfViWY
TLSH
T1D572F905D3EF8EA3DC825D319DF187827A3CE7834D62DB2B4159D16A2C633E8C961B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd84.rbf

Path C:\Config.Msi\e5fbd84.rbf
Size 90KB
SHA256 ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9
MD5 facce237d5cc5e89d8e92a36289f588b
SHA1 5b91fe97781b107df2754a5d38807a597f1d99a2
SHA512 f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0
SSDEEP 768:F+nOfOpzCJztUjm2ElyGv/NIvS1SHhodPxAoiStZp4uXhblMB/e8CKMduoUZKP4d:yy+zGztUjm2oNIv5oiIZZz8C2D4RRVZO
TLSH
T15993F626E23684BDDCC9003C75983531A73CF3B78256A78719097DAA4DD3B8BC987B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd85.rbf

Path C:\Config.Msi\e5fbd85.rbf
Size 168KB
SHA256 1246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879
MD5 d2d2a9e08ad2df5d73ca0aa0797cd96a
SHA1 f6050bc38d27c805daa078383506b93c5dd854c7
SHA512 197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de
SSDEEP 3072:fWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vam7xBAZiruL2b:fnMr8CSQ09ap6Jy65Rm2vp
TLSH
T1CCF309C1AB0BE061DC89563C38AA7F056F3CFBD295D2AB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd86.rbf

Path C:\Config.Msi\e5fbd86.rbf
Size 55KB
SHA256 89885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55
MD5 158f96bd130a9f3a1f7e91dc611e8b7d
SHA1 207264f61e8d8cd77c7dd82e7c8c38927bcdef85
SHA512 6ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a
SSDEEP 768:+RXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24hbxocNAwkEGjhl2BOBaBnD/sxFsNTl:ZSk2HQq9D2bPeVqv
TLSH
T19043A342D21A96D6CC55A5342A70FB52E63EF3FB1BE1B65F8813CCF408A3250E945F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd87.rbf

Path C:\Config.Msi\e5fbd87.rbf
Size 139KB
SHA256 38f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5
MD5 32f2ac5f45b93b733cab1865affd588d
SHA1 5062e6d2a8c1e06e19c9f0b29164915286ece618
SHA512 8384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1
SSDEEP 3072:DrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO++rCo9D5:DrwBZWkge7Dur/n
TLSH
T1FDD33A91EA35C259CE84C47D3E21BB00DB3CF3D644C2AB9F4526FCE84A8B791C552E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd88.rbf

Path C:\Config.Msi\e5fbd88.rbf
Size 351KB
SHA256 55758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e
MD5 18a9dd94b5112ea94f3fc9fc22ff8409
SHA1 97a0b82343ef1599e517946a2c3c259b61e53ca7
SHA512 7bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6
SSDEEP 6144:ENeM8oM6s8alZ+afj5OADOQ4pUE9wstZY:49QZ3j5JOQ4pUE9wst6
TLSH
T10274A415A3FE5761E2F30B34ACB40489DAB6FD479E6A974F2445A15E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd89.rbf

Path C:\Config.Msi\e5fbd89.rbf
Size 456KB
SHA256 a5a600ca8a60a0af629047ef8b227feba5221c5697f820da69e274f40869a6cc
MD5 54c12705dc6a32282762bbc4252e2b9b
SHA1 2d1fd38b5f3db7c7f0d7baee446a00099a506d50
SHA512 c4d96a8d8064ef917ddb98532360a8bf318535b310f908a384c0ca140ed058f5f3f24f34c3992da4399386f546381cbb1eef5432b3ff2b7c19e0491dec8d4aaf
SSDEEP 6144:I6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNic8iV:I6jwRSvQh42RNjN6YV
TLSH
T124A42B12C279D33EC2AE833754A226155BA5B2EFBAF1EF53A013C5E82C537C09D41A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd8a.rbf

Path C:\Config.Msi\e5fbd8a.rbf
Size 137KB
SHA256 7acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83
MD5 9f735917c0bba0f42b40e719047eefd5
SHA1 d8c1ef036b9d841db86ffc76d9150064ee836cce
SHA512 65522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e
SSDEEP 1536:I2jLPfRUqxc0O/t4DErSu9e7EMaggaqRgDPRpTCWFVmI:I2fPJUqxy14DEF9e7D3gaqRKPDrfmI
TLSH
T120D30A00A3AA0B92D06155351FF2B942E63DFBA76AD5E75F5421CED80CB3B90CC22B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd8b.rbf

Path C:\Config.Msi\e5fbd8b.rbf
Size 334KB
SHA256 7150db5b3af392a250b79f1078c87848a08b6c13448943d5a0478c2d37645b85
MD5 4b15c6de8b0cbeb6d4d7d6e14b9ca7fa
SHA1 af3b589712be828302778a6e248ebd659fcdabfe
SHA512 1f68f55cb4c32d0abf929b3382d9b773369f376853912829299c6386648c39807c6242eba037bb3988ebecd0e8b7197c91583243154c569bef1f70d0d958c491
SSDEEP 3072:700ASicZpLom0Wy0iwsC+KHIVKbHWuFvUOLKZXXZF6jJfIMRFxtZYg7eyXgMly3C:jlRAWy0iDCyVMvUYKZ+JICHNyPOB9Y81
TLSH
T193741B154268C32BD5E8C235BDB136124BBDF293BEF39B2B612695A81CC37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd8c.rbf

Path C:\Config.Msi\e5fbd8c.rbf
Size 75KB
SHA256 b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929
MD5 683fc126a13b915b3ff36735ea5ca5fc
SHA1 d1ccfdf78919f51b09fbde02c2cf0f332601bd74
SHA512 4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9
SSDEEP 1536:3skby0ayhkM+TeVCB5+G9cTvdQc1bqMsDvbmOpajgNiNYV64:3DbyihcwqHpa8N4864
TLSH
T1E073F718D7FA4FB3C2AA4378ACF1424256B5F402AB52CB6B18855F841D73B94CD13B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd8d.rbf

Path C:\Config.Msi\e5fbd8d.rbf
Size 389KB
SHA256 878566ee8a41806ee9b9c4cf590e1953881dde2127616a647fa31940a5096cc5
MD5 1a063e60707636e76e61ad9784bb1eea
SHA1 baf498bac402a29b1330fcd20cfbacbc5d245cf7
SHA512 39e2bcd04f4ee4e6280b7723a628acfbceef254fbea62833a34d7f4cba566c9556bfcfe2424ada027112a8b722da8349331ca416d00d0e3d6afbec96e3d91a65
SSDEEP 3072:2dxlMI0R4F60aGf0TX1zvAPuiFvVTLqtdte2Seh6mNfkGVq1XRQq7q9kAaKrVm29:nFva9GVq1XpAa+TcGR
TLSH
T1EC84F72073F94218E9B70B31ECB651C51B76BE67BE14CA2F2449315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd8e.rbf

Path C:\Config.Msi\e5fbd8e.rbf
Size 131KB
SHA256 a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a
MD5 d8a76dfe6188e600bd7a8480dcedcbdb
SHA1 40080e226be118c2a0a8f9dd70879467ec09f198
SHA512 9a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76
SSDEEP 1536:6fg4S0dRp1s8PW/OvAza4KFvQFa8xVsbtglOJzgP2wNmqgEEFBt9Aak/pKohxm3X:0N1zvAuFvVyV2sUz8mqc9AakhNhxm3Ss
TLSH
T1D0D3C41B93FC0269F2B70B71EDBE45CA5877BD566C21D25F044A368E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd91.rbs

Path C:\Config.Msi\e5fbd91.rbs
Size 7KB
SHA256 05ecc69e81c7be8249fd8b7604140a7b15a0557e45aaeb32b65787f3025dfdbe
MD5 7c21cc05d5704df6759b8bc8b4deef34
SHA1 167120aec7d993d0251464306c1ee121906e908f
SHA512 35eec58498a6f14dadab779c03a9e7fd75f7374b379dbcfe10bbec2f2a4c12e2a402df4ad05bd416741dd790f4ce88f85edfd1d652c483fc3005e3f6dc47d566
SSDEEP 96:0msXkqD5q78RKiSf9eDofeeVxhxq78RKi+f9eDofeeVCjP/kYk25c5fhxnE9X/nk:RKqoRKPVIoRKjVa/5iwq3
TLSH
T140F1BF62D6094392EEA3973087133F303BB7F6D793C5838B12AD52A42F067945FE6295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fbd95.rbs

Path C:\Config.Msi\e5fbd95.rbs
Size 34KB
SHA256 176874d117be12561bd7fdf02a01acb7e4a609d325cddc7df6e2d719aad2a878
MD5 194d6184ddfd30b17e12fb781962342e
SHA1 dbf00bfedeef3ce207b44d5345af983c52b46e55
SHA512 3e8b28454db14764ab33b7ab7dfaff6d8703e29f46d889ef0d6702f07c2762b42a16e7ad35182b95536a6a727fc886c7f57c6ef8ec7e1481f30aeea0a3e0b06c
SSDEEP 384:iRRK+dRKm1Vcw2RQX8yXF4vwmyoctdtc/x:i3xNcw2RQX8yCTdctdto
TLSH
T1CDF2CB5266449693D4A32B30D9173F663F37F7C687D2838B019CD2244F53BC26EAAE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nslist.hxl

Path C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl
Size 816B
SHA256 2a2c3bfac69ed00267b3bf1f78752b0207a11fb721634ef209b387dc01495cbc
MD5 05ea4d7d3fcfc5ed4b76b0c3e1c7cda0
SHA1 bb2dafd5cf78979a83e31cfe85055104dff5e01a
SHA512 a5c159ff09f5f2f426eff2981802ad860c918cae21630f9b946391e5baf9e8ec8c806e5dca85f41ebf7d8a36cb405803903f8222f88893d5f2556dfaf37f72c5
TLSH
T1CC01447553F45B14F7F768B21EF54C65BD33F1219A238A2E6056018A1139E60CD23757
MD5 SHA1 SHA512 TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\AccessibleMarshal.dll
Size 31KB
SHA256 b62b9ebb9f4dbed48dd5de682a73f0e28187770e25c6be4cda106df0c89cfe9a
MD5 7de6f3aedf355807de01c7aadc751d2a
SHA1 4387b26fa1c4157a2efa7ff7eef8489faf40c9ff
SHA512 e041b00c45bbf597e52dfa2835b55b269e04d65b06fbcc3498c8a4649ef3d3cc7bb67fcdc6db3c28cbb86e4c69ea92eca7f06b99ac81636eff2637fd69c7e416
SSDEEP 384:RGz3JfaZb/aO1aOS/viUGeUMc25hgT3pc2UtLIYiaxe8E9VF0NyxSJIVs5RL4yHQ:63JfaZb/aManvDGeq2kj68Yi2NEGBOGQ
TLSH
T15AE20802FA40C825D80E8434589B8E699B75FE019F9183D73365731D4EB37C26BB66E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\crashreporter.exe
Size 3.4MB
SHA256 180179d0b6cd38c05a5c6b42789517d8ff5e53123cef96004e27a476a069266b
MD5 a26f22b7c4c5e4dade46026358f7b32e
SHA1 4a15632aefe3b06254e1746b0357809fdbcbebc9
SHA512 030e32ba056abd1638b03edcc3df1935ea4806e0ab4d242768283635c1c83231d8c815ba472c01b23f1b4cf9169e540a1634b347f6e3fc7b07a1b0cfa0a68822
SSDEEP 49152:oAUF58RGQBOa74nO28wsz3iDT4JmeDNB05FQz/NTmXLhm6kV93:oAOwBN7P2Jg9f05FylaLhm6+
TLSH
T106F50742EB611DDAC025C07482266723B761FDBD073036F74A906735AE68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\default-browser-agent.exe
Size 34KB
SHA256 685f420616cb6ec8720f194bb9fdb45c79973f1976f2b3288f1efbf7b0fd0fde
MD5 a9c87b332300155735abd945a18ccbc5
SHA1 80c3c45586c30b39098ef6ec8addbd7a66a25565
SHA512 8203123ca15e130dcd8f1a2672fdabaa25abed24bb0ca88a756218686c7f017714c07924168e3b036a7f335cf2165c0fbbe283e21af4d2929d74aae1215df282
SSDEEP 384:fX/yd7YiyksV9tUHlJbdrxsPVxc+AUvaHgKbOK9D6UjTsuy2gMO2Jd2UtLIYiaxo:fx99OndKWQqgK3N6Rfg8Yi2NEGh0
TLSH
T17EF26C57CB9448C1FC5BD13AA2E15A37E671BA025B6191C7632683180F31BC1EF7A3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\firefox.exe
Size 667KB
SHA256 81a0316cd0efdad79c3f268a0e25a6e7133e9ad6ebf970fe0db36cd4e87ff849
MD5 af7223cf9bf7a64090d631c628eba868
SHA1 7a3f7927c2539bea7a877e1a966304302a093139
SHA512 f33a766daaaf593c22cd3dca277d4a62203280195496e2015ac1e5b7aaade0eb9af67b7f9596c206e04be2aea856b86f70d113ffb9aadeb15517e943daed410c
SSDEEP 12288:sOC854ZTW7EOggJXnJoU7s8oNXhaTWEJX36LW9zwHJem7OzwHJe0Ihf7Ez:sOvG1kQ8oNxaqIn4SwpemIwpelzEz
TLSH
T115E49E03F38516F8E48AD5B49A42D233E5723C840B51A1DB1BE93F2A3E71AD15B7876C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\freebl3.dll
Size 1.0MB
SHA256 d2e549985a4e89d26f46cad7a2c14db9da7c4e9212f37afef8711ac26d50edf2
MD5 67933fc47f4cd16d2bdf0a01ae37b888
SHA1 876df15d19198ecfbdb90178f210d4fbed64354a
SHA512 085e4bacdfbedd09fc34612fff21d3394d404afb389686c702ba9245abf6874ab6c0d141e987ea6f3ceabc851818a9e5039a50e5eff888d205f9963ac2d6cc8d
SSDEEP 24576:xCKe4g+ieBcVgZNQfUUxvfpHjJeP60TWHIBzQ+h4k:xRe4g+ieBcVgZNSHNc60TWHIBHF
TLSH
T10D355D0BF3A356D4C067CCBC225AB623BD21786D4A1636E757C457612AA07E0733AF4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozwer.dll

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\mozwer.dll
Size 320KB
SHA256 1001dce2a464d68fc29e358f5e3f99f00343c9bda5045f4c40e632174cca82e4
MD5 54a1a5b6852bd10be11866d544e17a1c
SHA1 687f1bc012fac2fc94f448223346791a98c56e26
SHA512 2f667959310ff649761e947206c8557315a962a344247fa0d3c7222d3693bdac24f7b6a9169f1e7329c29114ee4b6d76ff11c1ccd74e7011b9695180ff939d98
SSDEEP 6144:ix4O6QRr/2Vau7mrpieQG9yq3/S4hX6mA1gX:U4L8uirpvQG9ywSiX6mAU
TLSH
T115645C16F29454B9E05BC17883678A72A67378850730A9FF23E482353E7AFE15B3CB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\nmhproxy.exe
Size 565KB
SHA256 557e68441e15fccd55cbf3ac4746ca42615621b50c147f3375bf2ea08584d63c
MD5 8df833dd0e2c3305dcd1aa6a36e7b86a
SHA1 68935291645aed37a437f9d0e1dfb9f392eb2489
SHA512 8dd5752d9bf695512f6362db4a574b331b1efc95017d38134af62a6e56bd901ac47732c93d21fbab238831d34018cb28f1e688927d57af97eed9a66edd9d987d
SSDEEP 6144:IMYY/IOWAGsHLHxh2bfeifuISjnqOMEu1t+wp8yXTJcPuMo3/w6fhsib4jRP:IMYAIgce0STq0it+wp8yXNcPc/waheNP
TLSH
T1D9C44C12FA9794ADD51EC074874B86327933B4CD0B31AAFB23D85A353E59AE12F39704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nssckbi.dll

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\nssckbi.dll
Size 368KB
SHA256 7aa885f39f3cb5a07676c1adb4a10124c8c952f78e2ea7a4ce5a02176184bf32
MD5 5677d58bacd809ce78801362da84d8f4
SHA1 ae5748aeff3c30e0ff0e5c3d92766acb2a63805f
SHA512 bbb4638250d776bc77d31c1d8ffdb0ecec8bdd4bc7ae07db3909d43e3df85d275f696864b8358cdab98ffdfbbccc6e359aaf8ed98b97c65f58f5bec72d5ce098
SSDEEP 6144:oNSB27OYmYYQjpIvvLulViGJ243x208cGLbTS6tfpcmoK6MQ29ZAy5blM2d:oT7RlPN24h2DvLxtfp6EQ2Tp5blp
TLSH
T12D849E27FB28605AEED7C8B442ABC6233F31B5C5172129DB214284B46D63FE46E7C61D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\pingsender.exe
Size 83KB
SHA256 7a30446146320960780be8c3b41a8671b537d2cdc5fb8a5cd65fbc47b12f4d06
MD5 19b68c79216e8f22e544b2738f961a2d
SHA1 79a5a68655be692c4c1fcfef543c2dcdade16ca3
SHA512 58658946aaf85e1a74e449c20dcc7dc28b70cc2fb04663b93f950dab3c700575fd68cf7f1ab038c2ac82967aa6f9c65f5c7b72a3622120c16a41b52f7f8b31e6
SSDEEP 1536:fXLMQ5WV9j6j1aR80bi5xSRn6dhSdWA7gm:fXp5wj4aa0CSh2SdWAV
TLSH
T183835CC76B1001B9D851C2F0E1E75B13DB7976095B6A2BCBA39483512F463E01FBA7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Program Files\Mozilla Firefox\nsa2402.tmp\updater.exe
Size 455KB
SHA256 296f940432e0692d9c8bf939a21a02da1d94f40e72f52eecbfff637f627d67fc
MD5 bd94cd4a5b339cd8c5c669e563af344c
SHA1 c2011c644eaa71efddbf51fe9383309567a9a324
SHA512 5adfe608dbd14da082358c91658e09130543ee933ebef07d76bbd136f93580398d82462615b6f731ffef522ab4d5a99dcf5528a09d738f9cedba54ef408466d5
SSDEEP 6144:upecLoX63falExb0zqOzyUIb7U+AbRUSQ9i2ZeG33qCN2oivJg3PfcKrKyw+:upecLWREJYqOzwb7AcE2ZeGKSOJAdGyf
TLSH
T180A49E29F3900DF8F82BA274C9A28511EA73FC554760A6DB23A4D6252F332D45B3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 178B
SHA256 dd8ce7e8437f0775742f24d51ea016fb440e585f4cc968a616282ea88b67a0e2
MD5 50beea27f647cad446fc06d97bc754fd
SHA1 94e9317d53264459f822f328f1d883df392a09d8
SHA512 6c2c279f0c7c90dbe2ca221f4126e806e44a6de4565bb83e675d69e34fbbde0e9edaf94861f0a9af00001a2a78c2673e7cd3d6339ff2535528030b3813981d62
TLSH
T10FC0802DD2E931204171CD32BC749011DBB1F4212C1BCF9E06C0518B04E1E05F732743
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a4ea8b8be1451fe88f812f0e136bf56744968adc22ba72ce7006f3e1e1037807
MD5 ba45f966ea54de57f69c358e0073dc0c
SHA1 667cba6254daad80766aff4069ea5b0a6b4f92be
SHA512 22c53a7139bda25ee80ce9f8c58aac52a8308f7366ea43f91344610f8b8b4acd1cb444d7ee6e647fa4cc932a876a7047c80822fec841ae05822048be846cc281
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 35abdd83d56d102e47fd9f39020010ced6f304c739064fdcdbb2b7b7ba2d90d9
MD5 b9c0272b86c37373358937a76c14d858
SHA1 25c6e7a6bc5a5ce85a766b77143508f44b07efe7
SHA512 627579557127c756f657519d66bf60932185851cb2cc73b6cbfa3301c7db1e497935fa896c7b28153aae106c7080b1e917b9c03e16b35c95714e0841c8961319
TLSH
T111E022AACA21EC3B1DFC0B5898844A8BEA0103672750494F3F3E9919CFB2A364586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 0dd936adb8d51db4f6a5ddfdf5f788ba5ff364cf8d3e429d843b56fd4e56e4c2
MD5 a3486812ace3cd72962db7ea5d43b942
SHA1 e0f758b500dea175f91cdd862e16707134ba886d
SHA512 7803420a1e0d556054ebec6bf69d1ac0c627ddc80222f36ce5f1f5392fd2f040dbac2e4e7bfac97e155290cc58fe373b3d6175ae465d6afe5f1f38377ccdad70
SSDEEP 3:MsEllllkEthXllkl2zEklo2l:/M/xT02znoC
TLSH
T10B44044C7FC00445C74010744031C3510370D510051777433451CC13DCCF5405C10410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 738d86163f8804f965f824b4d0447e22ea8260463055c6488cdeddc3c27e7f4a
MD5 710cc2b8c3bc6bd31c81c44e1a319520
SHA1 bb3745ee793e3c0725a6ff64a111b475aa36e935
SHA512 97cc5499424d7dcb996fef160336b8a81cd293540ab6a6bff7465b17fb47f51a328fdfe18fce8aed4a8e0374ee898b793ab044462ec4cbb18e4b35500f299d90
TLSH
T1D7E0261D35C8C56D449B842386FC534DCFD03419AAC93902474D88887186505E280B60
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 261b890e31f6895d9c0689c8a03048bf49edc2d5a0cc0e12c2125067ddeadcce
MD5 f27f8e9fc03768badf5371e5fe30d4b9
SHA1 932750a3b45d804d525e10215f5f2139cda17b5f
SHA512 333ef17394955e8047c0a60eec9874d4f939afcd8c100acb145f706a2c11535d05f6c1157b7932a293d2c12858468207e46b19c57cc389a15bf458178c4fa03b
SSDEEP 3:MsEllllkEthXllkl2zEklj/l:/M/xT02znB
TLSH
T1F844044C7FC00445C50010F44011C3530370D4300731774334D11C37DCCD5404C40410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 948d5af5272a793842f30d8feba4b31b7d309bbc940d52360c7b63445cfc8c21
MD5 379733a55952bcb82c34f98603081171
SHA1 608ac5d70fbf23a98af0ade14fbdf6f63c431c0d
SHA512 4d7526a427b265a4aada8066ca92397b0887d865c11dca2c5eff65c4101ef19b23c68a4adbab72b43a04ff9f8a3d16ebcda69919f7d4d0cf755e8cd4e4a8d034
TLSH
T1B0518DF7D3E4857DC95196F4DB216E2FCE2E0A14131C3C6688E4AE5B83E2972D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 62a6801dfd378a7634f3e0441cd5d0cf9593f3ba1bc28c7a066565a3befe26f2
MD5 a719ad5cadc4c8328dbe6989e65a5899
SHA1 f966956039afd47c0d6bac1aaa8c9667a2c26654
SHA512 975516d144597302c5e9927cd5565ef359710b5f85a8ba9848e1482f8f41707876a0728264c8e26d15b618b9f0a3bad140e45ab2a43bfb6e9cebd0e6280570f1
TLSH
T135517CB7D3E4856DC91196E4DB216E2FCE3A0A14131C3C6688E4AE5B93E2972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e406e557bf9047292e2b805d4411d654bb2d87c18e466856158633591a2c8595
MD5 2548b3f014a5505beed597fcf35f8898
SHA1 859b0498f889b478d8ffb6fb8643a48c9fb00acf
SHA512 dbbf1fad3c833ed132c3df1a73c0e4b190144c38eaf61aa6edba6328052803b2c743d0158c2f510359749e6e578ff5e51ec4e4e9731f514299bead488e2ec475
TLSH
T1AFF05977A6BDB02310F904FB1D10BC0928B5B432064168F5CF7F81BDE0921E30B12863
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 c7560efc867dfe93922aeecdc437a5b490ae44ab97b2877a4f42addb497d8065
MD5 f5bab69b2a52f3f4c59b54b9e3a40276
SHA1 790a90b667ed1a054b6b4b59dbd023d75a9b0070
SHA512 dbd12e67a1a6755a3d54ff7f1e83cf3a91e857e4f198369376ac95fc401416532de25fcbb98c34ea880fdd3bcfffe1ac2337b601866c294344ef4ab9e0c357af
TLSH
T15DF05067967DB45320B904BB1D10BC0968757431074168E1CF7F417DD0855E30B12853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4d5b959e68e13c584ac320e57584cb816c1e63f653721ce009bfaaf77762ced0
MD5 94cc510c53a938b7f172da3da54cd243
SHA1 28faf62cf5fb7ce2c76c292e2a12f08a3869d87e
SHA512 5b2a18e8407f1533eef6a14bfb3a097831218a32d4297ff78bb13cb2afe736df0f93f2d631fb1a41f2904b8f54701b4ecbf4a87ad6eaeada42901b461ef4bf20
SSDEEP 192:xRjn1x0Zx94oNCv7sBpAPRp2Z9NHsb+WNnuc3Dh2DPuoNy2RLtS78yIsnAUgtaJ:xRj1Qx9PO8UXerwBN2LG2R38
TLSH
T1EC52E95EBE10793B6CDBC22AF9227713D3F5102525D81E84E6FC8A2C15E79CD222781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b3613aed78aef44a0cfed50d12c5f69d953957023071a4d49218abd711f184e1
MD5 8a8e1a74e04aff3d3e19fc36f95d9bef
SHA1 93f56bf19527e400fe2dd6a7caddb5dbe321e43d
SHA512 1a117095940c2405866cae191f5ea78463b3fbb189f0584f9dbd92521fc653304c721f7f799ce1f9e3b4aff259e13bb385b2f4720da3f90ffdfbb483509aa6af
SSDEEP 192:xRjn1x0Zx94oNCv7sdpAPRp2Z9NHsb+WNnuc37RYjPuoNy2RLtS78yIsnAUgtaJ:xRj1Qx9POSUXerwBtYrG2R38
TLSH
T19E52D85EBE10793B6CDBC22AF9227753D3F5102525D81E84E6FC8A2C15E79CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3ebbc05c096b0ebda1376f02874573325ba6734295d9695560d01491c083caa0
MD5 09c607f5b6795e68ceda4df2a5f44d22
SHA1 4730f31fa218c4262328ecaabf3c2317e290fef0
SHA512 afab4950764de6522bd5ac5f80a5b8c19c2bb3488b459a2124dbb17b9c1f6453d41a76fcef269a400e2b9fda514e951ef70cb758c8e9dbc32ec49d271ed96e87
SSDEEP 192:xRjn1x0Zx94oNYHv7sdpAPRp2Z9NHsb+WNnuc3sqg0PuoNy2RLtxSFyIsnAUgraJ:xRj1Qx9PYPSUXerwBJgQG2RUe
TLSH
T12852F96EBD10793B6CDBC229F9227713E3F5202625D81E84E6FC8A2C15E79CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3a727fbfd80944e58c6bc768ef54fffa72dcb2ff8e66391503207861189216d3
MD5 e59d0d97b005b355881523e7ece7493e
SHA1 add2153a501abef60ac3be4fb951e3b1b30dc759
SHA512 1e607d00dd9324fa98fae701dd81d28f41064b465a0592e46347c44e35a18edf8623794ea102e2b905de0d569d70d495e8596444cd367855c2b70835f9e4f5a5
SSDEEP 192:xRjn1x0Zx94ouov7sdpAPRp2Z9NHsb+WNnuc3sqg0PuoNy2RLtxZSyIsnAUgraJ:xRj1Qx9Y0SUXerwBJgQG2R0e
TLSH
T14A52D82EBD10793B6CDBC629F9227753E3F5202225D81E84E6FC8A2C15E79CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 f9e432b052cb2d9d35b0ffc2db088dfcac4cfe2147faff20cd56ee1bd2910b6b
MD5 643a30b50fd3a43eade4c00023e72dcc
SHA1 7692cc8e8aa51c815aabd108d792dccc8ba55bf3
SHA512 65e64e217fac5570448d39d014fb60786268b921fb9c9e498f31b917d359d23bfe2b8fa905cde58a070f2859f66b2ceb64d5ed8546ddb7433d25feac35f04f54
SSDEEP 96:F1mKRMLRwcnDh1JDcgLXbXFXKXT9tFXSXTzXFXKXTgtxhXsXr0XbXNXKXTquZXI2:F13KqmDh7HL1aj9TCjz1ajgd8wL9ajtL
TLSH
T1C2A16B6EB909184EE4AE4937CD78571B6F69CF0C27FE3767A9DF8A0405B0A5701086A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 fc417f1a309102e92bdd830dfbd828a2b4a8cb16625e1b9db72f1f6cf3fc331e
MD5 5a65deb1d0be09ad5a1a1d13820133a2
SHA1 8caedf2d6b02810accde9b911b410f01f064d735
SHA512 36d7b5d2bb357016fc515a3821b1469654e156ad14036ca5eeecb7f2da98dc6bc31e1c30d65c695ff141068a069d885932bc181d92fdfe3581a977f42db1f42a
TLSH
T1FBE0203D16C4C5BD115B400715D8930DDFD8B45BD6CD38011F84C84871CA408F191B50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b0bdf1c8eba38fa4ba81aa9d959cb3caffc189bd20995204a1f30be10afabff9
MD5 5437785b1a6482cac69e46baa68b13bd
SHA1 3b4f69dbdbbc4b098fb899ed6ed6a6ea1131b817
SHA512 574cff6d6f43aba06863f618339143b1c0da4519b1d5f474884d2e2b6b53822e911f1382ee09b2ce97269d86cc5bc3c9fc75b5a1adc974b89b4d14b85626623e
TLSH
T1E7B012508441B101C01302F41192148C71649F11970E1F0243E0BD26882615080140F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a31c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a31c.TMP
Size 96B
SHA256 6d786a31ac14ee1464fb28d2781e8e5117c6ba7e8a8cdd78a2e709fc8ca067e5
MD5 b0f5a5ebc0fe526cc2cafe93986967b8
SHA1 f01def11a7d3f4cd275fac45978eda2f1a2e08f7
SHA512 71c02fcf436da00b1908ebcd13de934c7ec9671534d6754c42fa99f60c9f96129f2191fd75de29f145b91b629be833978045aa224b5adcebc46ced547beeb835
TLSH
T1B5B02222C0033303C00203B02880A0E838B0CF22C283C20282E00BA3CC2CF220322820
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13430108808199473

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13430108808199473
Size 11KB
SHA256 e3c155298ced7d0050bc7e330d1f2ef02562475a3a08d777e3f98d594be1b36a
MD5 83b4d8f5f34590186f20c8fad929d9fe
SHA1 4d0a5ed56e6684296bbf3c212d645f73180ef3cd
SHA512 9ac719ab4a13714ce88537f35b780571023159360f9c3f04c2203b8c80a1a75e8c05c50c6984a13e0589a55771fdde98e55dd611d6449ec1c6321bb5302a3693
SSDEEP 48:327Ah+9EiciIfN+iwnH0CYI+/CPQWmp9oeiuiIfN+ii+lmCkM+u0v1xUqMrCzaQi:3tpTjhGM+DdmqMiYSWyXlUxdNFiiX
TLSH
T191327C355595103FE13F4537817902F2AE71BD1136D69E2FA1A421484C32B82AFBCEED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tabs_13430108857802473

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13430108857802473
Size 6KB
SHA256 a6a6cb03d2389b8198d04e4ece1e000c9fea1ea2c56dd0d5ec04e96a321146b6
MD5 7c87c578339779c0e93c0f9ca2c4c6ee
SHA1 d39e295beef378f6c2e0f53447f05a26e7b7df0c
SHA512 ea69d8c315535da1b3662094ff9286507899efbfca7c25fdcf63f6ebfee82cdc50da96ad01cc3e2ee236b5c6253c4ac82d0d87be096e68245ef699eb59c6ae93
SSDEEP 48:3/zM/mCkM+u0v1NCza1CiYqCqbjjqnCIlUxQSN6xC9yK5c8nUC1sr:3/zMQM+Dd3YSTqXlUxdN6Fiwr
TLSH
T169D119354689147FE17E4576806D06B26F61F82237D68E2FA0A052484D32B82AF7CFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 2f2ccaf8a422058f0313c47368be386ba0d3d9191a7abb60f94db9b8e7d42a2b
MD5 9a9e06b7cc8d24feafa9399c99a1f141
SHA1 f23a23166e1e1580a623263e9ea01920c11dbc5e
SHA512 b37a1fbdc6f641b954eed5a7d5fc72c6436c2543a8e500928163c6d42e09b959970a6b6ed61d309a0338e17c154b1232393986a2d95ff00b54a22bad9c532919
TLSH
T115E0D83C26CD8A7F16A7401B62ACE34CC9E1B841DBDD54112F08A044D289408F282B50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 12b805bdf33f673e346883774aa19e94a1ea6d931ea0a15ea6103505126df97a
MD5 f00bbab15ea222cef6bfec02a9c956f4
SHA1 d3246c220005b5acd4133cb4fac6d6ef4670876a
SHA512 03aa797246d0fd6df05658bd01c1ad1e3f372f115665ccf5ecd66fd19c983bf668e4f585dd96f8f72005dc0479eca2d06ee5657bc0902e28aa30e536d9bd807d
TLSH
T10EE0867877C9CA7D5986C05B66E8A30DCFF0BC869BC9754667085484A1C5504E2A0FA0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 87892a94b2712e51af4216996ac1b5936f6d36a1ffc6a99340a45aea1c033b30
MD5 366709b9dd6b9f6e6062ffab92a11ac5
SHA1 2fd0ed0c9612293678574df61f7fa005d29cc87c
SHA512 e3c004a96cde810e060da35951e1dbee583f82edad38dd7262b92c6f953fa5f96abaff525de394d475e3dafdf14b478abc839edd88ddd6cfbaebc497dd195866
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4h+XvXk:7ZT0nzXggPfU
TLSH
T12F03608F662850F3D0B6C13EE9C289D6FC7C260CA3237ED519F907655DAC03790582AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 00be812936579af91a12c54bf83cc949beeb822d9bffa29fecdb82138c49a0da
MD5 2bcc6b9d7bc0816355cd40f1b73c508e
SHA1 6105ed3f75f6dc7766d2f894c61aacac68b843be
SHA512 eaab942f87363d0d310cd62e832c43c762524cd38fe05e85aeb4b2f321dfb80c52040ae1db51e61022823e15db14529f192f1e8b7bc965b7610f7d14a13430f1
SSDEEP 6:SF/fqVkXkw+r+Bcc/XKuqHKu42ntvrCc/mLEJOgLEJLWOIn:SNfqVkv+r+BXXwX4QJmLULIWOI
TLSH
T1AB02DF9FB404680AE82D017DD69ED9826D294E983BC27F9A29E649082CB82178008386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 205729d23600f7a1c5b1826283154df11c6f8e0c2a35557ba962e83485ca4e90
MD5 062853304dbff2563c37c967ea084915
SHA1 a0978ac22715b42084c79dc33efc0c8d624f73b7
SHA512 52a34dc1466ae2286a487fdafec0e532f1e0b1e9fdcea8f23cee91ebf03ec57efb3c87c5c8ee49c527b2492b551cd28ea7b50812655d6297e7149da4a93e72ed
SSDEEP 384:Q6LCsdGRXgQXIIImbGMIMNBTKaBsdGUWQ2VyfsdGzwF5sdGsdGj6ca6J:uXgQ+C6EXa6J
TLSH
T17DA2E69AE3700B8EDCCFE7FFA854CD7E07B28C89D4551041749296FA2863E064D49BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 25aec1b98c1d6e54555f2eaf8da83d39ff37292934a9a4077e7ac7df8df3d965
MD5 85316761f04b47780e3c5fea9c715314
SHA1 3488e818363953896e565f5f110d26cb1dc672e6
SHA512 77d959c9f0dcaa5bf273f629f056de4ef4fdfe86bf830d75302beb90fe26250cd3ac1d9811261ccd71918bda0dc4ea8eb019a871ad15caf62d0afd0551a6e19d
TLSH
T115E086697ECDC5BE6D67C05B25EC534C9ED03817FFDC544A5F09C48C9189905E2A0B70
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e5691c5ca3267d49d1fe42e35c7454dc3fd7ba7d59433241e7af224e39afba13
MD5 4d5d9035bfcc35870e064b4e41b7facf
SHA1 46cfb37d9225ad2da607bc7928c290428f06f14f
SHA512 b653400125b0887c013e555c770e144bf6c90d5988824001b20244adda83fcd8fa1d8a4ddd2828239a0d4a1e87c0d4f0bd11d610d02db26bf3a1dc9917070620
TLSH
T16521F556F331C248D25A463A607FAB151334D4569FFDFD0F04B620683EB6E040E476E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 bda9257afab22dfaaace84f37f95e79aff49d37edb33226d272c332aacf042cf
MD5 f34c04c847147f34058f0fe368a01c69
SHA1 324f7175ac806565476ff7471a45d7694df1f49f
SHA512 5c2588fa04f0f58739cbbf0b1a7bf35061e304de74ac77999fc4e29b0f8f6e577d484a290d2ebf997ecef3e3afef956beb8ac1a3889e5dd34cc3a3185c3727c9
TLSH
T159E0DF29798885AF4823801711EC93489ED03812FFDC2E0A4F08888C9188805F2A1A70
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 9a3992b6b59765bb8b8605f431984f7fe8e288c5f65b6d0a15af610b98d61adf
MD5 67d33ac9b96844e371fc70f3265ece36
SHA1 c200f556264ce5522ace4563cc448f06fdd464dd
SHA512 cf5f24bce7e6f86e3044fcdb93b21974152388be423a4df8dabf63cc0ac54f6dc926fd69c280bff94100f622e2cf112232ebf5fb5631fd9612e562590f315229
SSDEEP 6144:taDuqWhGX9NwJUwc1m7Rkm1tYpBeh2BAoM:ta6DWKuwc89oBGcAoM
TLSH
T1AB3423379FE87C3AA9ED9359F18E052F5EF2CD6A8921D496D4C42A04B1C7AEC0C85874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d4d2d21e0dc1f5bf922a085af59fc8ee8f7ad2e99f9f15ba7599a594cb0bf7d3
MD5 690bcb8bff3292e9bdd5670e1f7ba365
SHA1 2d540b19f58ab55238a4d2b4ec592b556a73f540
SHA512 268ce6273b17274a99efe2e798c1988d5204326202d1824f41daad757333a496a9d70bf1b614ebaf3a6fa2f2c7c90befc0a398fb8da78a6223e83009d08df324
SSDEEP 6144:6aDuqWhGX9NwJUwc1m7Rkm1tYpBeh2BAo/:6a6DWKuwc89oBGcAo/
TLSH
T1943423379FE87C3AA9ED9359F18E052F5EF2CD6A8921D496D4C42B0471C76EC0C85874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 be47f1ef4be40c2104a73e033ace56b7ae81f623ad5575fc07d99763ec8c0ca7
MD5 b249497534dc993a2c8e206d2a7f11b0
SHA1 3f00ed4b106c250883179a3c48d13158257123fa
SHA512 0ce779d562f59babb71d5cda1e9183245c3c098edabd6a29a2a7768c54d373fcd557fe03ca17eec3ba0719d01a619f242cb00675c652d1ee4f52b12a509aecff
SSDEEP 6144:4aDuqWhGX9NwJUwc1m7Rkm1tYpBeh2BAoM:4a6DWKuwc89oBGcAoM
TLSH
T1C33423379FE87C3AA9ED9359F18E052F5EF2CD6A8921D496D4C4270471C7AEC0C85874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 02546363c388aaaad90b4a7af86dfaf2826b17fd87e8e11979b986b1c4a9a3f5
MD5 8a536900708719aa521e55cb7caa0892
SHA1 f1e34c51e3e7d4736b5ec11c6f6c37e35c75d276
SHA512 b4c87205c015d619a74eb784b326e8dba6831357dff8bf5e12c230d721df437ae9e6c71bbfa2b6f5708f105fb196f52b4b126da591a578d0dedeb4b7342c17bf
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:3m7Rkm1tYpBeh2BAoe
TLSH
T165C3123B5E65A9775DB5AB0EB08E0B1F1EF14EA6C920DE82C8D85B0427E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3489edb37c5a54aecff647748468ecff68bd6b27a30a2310f0b44d1b25bdf535
MD5 45323dac99f02340e22c9c34eaad81e9
SHA1 838794339bfe9584d7417c79d07199bc94b41f06
SHA512 807df4688a5642da958f27ec1ff9d2b1a4fdf00ccd1da8df00aca48883f67b3a7ec08859e0e68bb0b3a085b45ea1c65004009284b60a79939917e07d4dcfba96
SSDEEP 6144:PaDuqWhGX9NwJUwc1m7Rkm1tYpBeh2BAoM:Pa6DWKuwc89oBGcAoM
TLSH
T1FE3423379FE87C3AA9ED9359F18E052F5EF2CD6A8920D497D4C42A04B6C76EC0C85874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 535c33a93eeb0475b837351d01946dbba2df5ff3b21d7e5ea2d37bfa7a0f6746
MD5 5657e7d03152c8d4d70be6977e050674
SHA1 b8b6b43cac04c091a347dfb21b9c389709a8a2da
SHA512 ec1429805e50ddd588ab4a0123777e25e33f4e07bda6b3c3dd9395c978e7a03c1d8cb6f32f16ddd258122c9ed1907690f9f4b00ba1c0779e44d2e4410577bdb7
SSDEEP 3072:vyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwR:KaDuqWhGX9NwJUwcw
TLSH
T1BEC31235D3DC3C0AB5ED8254F29E103FDAB6DD1E469294AAF4C42B1AB0C74F80CA2476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b8dec1bba01ead0cdc53c927c8363153105345799240ad207d7c69fde7c0ca25
MD5 d4cda11ea40e3b8d1880f6d35e79d649
SHA1 b3d37a656e307a820d462bb5359f64e7485aedbe
SHA512 4bfb842e72fb439b856093a2b01bb71c8fde646b2321123a9c90662fa2dbd0033cf3d398eaa99db882e62bd9f4391551a62974c1429720be3bd903fe8a62512d
SSDEEP 3:MsEllllkEthXllkl2zEklzI/:/M/xT02znc
TLSH
T1044404047FC40C15C50010714015C35143F0D4501D51574334551413DDCD54D5C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 a4d8f603cc91ee324bf56111b51865ec3ca46d772706150bd5dc867f3b97f462
MD5 a9aba027a6ec532d8990b05bf2644317
SHA1 00f7ad2e7a91313bbf8acbf610a29d494f8b2f65
SHA512 61a80f0489e89539a484cc8ea4f5c6f4b7673c1bdfda3e364f6a1d08baee14fe796ead6c0de7d94263de2aa948add77449f6c52a6b18b22fae491e094b7996ad
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0J+:TkkhCU2QB2zbBxxjG
TLSH
T127238A4E1B6821E9D5D6183EFED24D617CBE0F588B2B68D205D00C764CE109E553E4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f84bc797307c0ae2ae9e9d8bff4e8596fd63969053871eceacc58b73dbb40220
MD5 57a4b710164ae80241593f38310e2734
SHA1 8b602adab5c8a92ea081fe27a146d65cfc27e5bb
SHA512 cec66983e65a4685c4494608d9ff50f426b42c8526d5a24e7becf16f690b0e6b5759556ddf2fc9aa182eceb59933b4a2b191b8f1ee33cde8207d356fbf8f17f1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be8b26be52010f4440dec4e07ded55d1469ffe8584e2b0638164f11ecca4f9ad
MD5 858fe2602ef1c8b54552e64492bbf738
SHA1 0c76604af96b21c631154e1dfda7210256212c33
SHA512 26ee2bb3d6a488783a62b79dfe86b29f03cec52d7f474ef1ade2a8df78f2264267e2d55faaf0b93ffc3d6f137c469ac9acdc7ef3700f3b3d3c668473612cd69a
TLSH
T1AED023717D3B65E0DA19013C446056123965016327DB535791514C4DEDF0084D2D79F5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b092196004d2d21796954ac3dec1a2fef36d8c3e84caaffb1f7b52933889d745
MD5 eda79fb66f8dfcb7ddb14de7d2c0fa40
SHA1 73b89714495683ff3d844eac3ddf15eecd4d4e95
SHA512 9e5499da5d8ac3ed0872ea8a866ff7ccc2daf4615f970120b19ce771afc768476f4c46fad199b185144634320c3964c4169a764ca1b7326f2afc2d7918c9b4e9
TLSH
T1BFD0A7B0BB169660CA0941385851A6112AB1412425AB8663D051588D69D4058D2DA0A5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8d69d031727f2c3d03d6c12675948f580e614c200cb773c230b7bb6bafb64ed
MD5 023d0fdcbb075bf38db3bfa7888fe025
SHA1 e01bc7d12848c64c1059cc893ad04cfa411057ec
SHA512 4bba0128695552e213f313ba2b03804413c2df82aa530dcf039d2eb8d0d8207223314958fb8221fd72877f1b11884eec657ca8c2df62a3a6812adc3436a2c3d5
TLSH
T105D0A7B0BB169660CA0941385C50A6113AB1416425AB8663D051588D69D4058D2DA0A5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

17ac3bb4-1b95-4813-b28f-14c0dd8564da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17ac3bb4-1b95-4813-b28f-14c0dd8564da.tmp
Size 414B
SHA256 4af1b8ca2bc4346590bb9c2a5967f98c553f926ae95bea8a43bd73268398d7a0
MD5 782921fac50f7da93a2fe2f487ddddf5
SHA1 ac69d1b90d80f0fafbebd896f52804b1f973fdb3
SHA512 4efd6554070a1926f1baa3b2c4143ff039508b270311a9325912661f34b5ac99af792d933869692b4435cd7eddf2e5ec8065f3d9a78fc670478977aac5bf9323
TLSH
T11EE022A9C921AC3B0CFE07289404878AE612135E3A90495B3B3DA40CCFB0B36468A82C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0bff2a845530ac4c183262ba5bd47e23d79f928b197820dd9e7f2f1ffe606537
MD5 18c0429e9da43c750ee2161bc61cfe13
SHA1 02093dbcc488c1dbf899c43bc9b3ea44dd27d5db
SHA512 fec6b57a2cfd2e475144cb1b713944a61a06c0c19cef9e340f6dec7b09b2cf6ac9ab1a8d377f4757c9259bee1f311937205464bb761e44c189dabda67df9df18
TLSH
T191816E29CDA6CD43EF60D1B498DF2A5B347F0C56CA331EEA01C468756F5A362CCAD624
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6018d2e6c0f70c60c499c4d6645ee4ee156605538556b8c43282a21883cefc1d
MD5 eeaebe22eee58331b4ee170bd98b985d
SHA1 0eff8eaf4d86c50a0154c5e6404fa5401d7c3251
SHA512 5d26f7f4cf7cfd51c4023b2d86029f3994edd7b44675d71eab3492ab7cb31e815aad0beb43326b52c59ee5f3491b88fd8259ef0b2261b6ea639f8eaaa3892546
TLSH
T17C713B35CD56CE43EF61D27098DF260B34BF0C66CA331EEA01D469715F5A625CCAD014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587654.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587654.TMP
Size 3KB
SHA256 e2be5f1f66b1b9a29c3079e552d3c2f6f975db8f8477acf951ffcf81ab716050
MD5 ef4e6663932627390ab7a26da18106ce
SHA1 b183a92ca0caf82057fffa530746923f5806c2a7
SHA512 ade6a527a4db3daff9a343b88e687c7f4d5be2a43661c09eb49ae1310cee201459052ef9f36a9fecf4a26e509d54fe54597dbb250582e5c7e46bbadc52182d37
TLSH
T1BC611A39CD56CD43EF61E130A8EF620B317F0C66CA331EEA01D4A5716F66625CCAD008
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 892a11a958726e333ade430c03fb0833001a1f6d1f161a193645f06ec2dea07d
MD5 694121b4fa4c1b0279c23d15a75b264a
SHA1 5d9896c2efc9df41f7fa612bf1e014490cd53eb8
SHA512 f971194f3fb32e527b9c69c3fa707f76415959097dd834b1b8a87b912074117a160ba36590414e88f175189cebef4d0246110f63b6afb11055824adfaa7e64a9
SSDEEP 3:MsEllllkEthXllkl2zE/lYY:/M/xT02zNY
TLSH
T1DB4404147FC10447C70011F04151C7541771F434071757433551C433DCD57410C00014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7aa373936d986b9de3691a9adcf55af967e2d2855ee4e7224a16ea0a81e19903
MD5 9174c4a811298f9e560665fd194f8295
SHA1 cbe14bfb4f5df97b9700372937666309a2e3ba1f
SHA512 6d4b2e656786854b03e24ab6d938cd53804c6e23a3d23f457e31e8bfb7e7b7051c4ec6315806adad694847790d2cf55e2feb1fbb83c0c5b1a26615b36a13a89a
TLSH
T1C5216EF783E1856ECE1156F06A14AF1BDE2D0617435C7D1589D4AF2B93F3475E001A8B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0a009f28fe5a59629b1da1e9a52e8a2fc33e28af1ae9f77b98891de0ec70e219
MD5 a472f0cde712a9db389b8bce99ba6c41
SHA1 9173a496e211a6930f19084a8810ab006e6858c1
SHA512 0c1b22c7806054e416eb8a486c35cb6cb9a5a4d82da329e0a2556b0e1006941a0d8ffa9ca7e302c29a9a0598d274f2ffa678977eade47e58e6b0e21f8e61a58e
SSDEEP 192:DWYyeCrqbkJzXJBWs1neX6abbY7RAeVpyIrdr5piQqOZ:DWYyeCrqbkJz5BWs1neX6abbY7RAeVpZ
TLSH
T127F19BF7C3E8811DC94156F4A715AF2FCE1E0618432C3C6A88D8AE5BD3E2871E255B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bf8dffbf763ced5e4cb07bd01d50e3881cf7a9585c3d46800f0ad5756798d067
MD5 eccce3f7fb73a129f1538550df5b88ec
SHA1 efd6d698d7f1c20fd68dc771703dbc509b5f2471
SHA512 0d4b5ed4b3722fe784d076d81962af4c51405d57c09e4049749ca0aad2a3d5de63d74cc6b0d44e3779bfc59188b106f2199ddd258b9951e20d005421c941c276
TLSH
T17A216EF783E1856ECE1156F06A14AF1BDE2D0617435C7D1589D4AF2B93F3475E001A8B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2525b4a238862bbf850318f4f691ab1735650b63efa9940d0f7c2c34dcd1ee6b
MD5 e8fd5de320b766c35d15e5656134d0e7
SHA1 b74ff90f0ce4dbea1b50a6a93bd6f3c6e98f4540
SHA512 faaf483bb2df789d334b1cbde3054d076b201de2676a1919de937671667e8a06204d841dfdd66f47ef21f6ce6de1ff9b6eae6db1c15310b347e0650955a1f2eb
TLSH
T13A119E9790BEF427106C4C7F1D447C0A69BFA83A069178E5DF9784BCB0C09F31B0A016
MD5 SHA1 SHA512 TLSH

Submit Download

a2cc7145-c707-4776-bc10-e8d0a5a38170.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2cc7145-c707-4776-bc10-e8d0a5a38170.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d8174ad0550ac3f42040e695402ea0220935438c2dc88b9259c7c3e3ae0243b0
MD5 d6bd6fad0e410cd42ec63c7ada2a0389
SHA1 34afd705b9ac66703a8cf990e8e22f7469411ee1
SHA512 65ecf27bc916ab3f497ac4b9ddbcfd8981054b65d02ebe45ac8724ca12eeb378fcc4ba47f3ca7b2c3aea20471a1e45e6fd704950a4485272bed853e56751c4ad
SSDEEP 192:sxZbR7yM/jK1Ml8MFBj/f1sF06Idp3T/W6+WNtxSJ/Y0aU0xPIgrJ:sxZbtdN/f1sF0TD/bti/5K9
TLSH
T11752F811AB346977CCDBD209BA55BB53D6F9047392910E44AAFCDA1C04E6FED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3a75a1195c3cde53d01450054618b43fbafc19709db7f6ff082905da25aed4ec
MD5 214de581e0b29e684c452ac8e251d5a2
SHA1 76b17be97b95aee6c4d37e8cd3eb8acbc63209b1
SHA512 bb0c73b0e1e8229a80b3713e6f59a3ab0cc06e8e2eea8c988689a7a103c1e7397b4ffdace6fb8b7f7a2413517b8095a557d178d182c0187f0dc18ecf51d7fc17
SSDEEP 192:sxZbR7yMwjK1Ml8fFBX/f1sv1WpVGO2a5IdpFT/W6+WNtGkv74xSJ/Y0e8z7GIgR:sxZb0Et/f1sv1WvGO2aS9/bt74i/5MR
TLSH
T12462E801AA34697BCCDBD20DFA45BB53D2F9046392911E54AAFC9A1C04E7FED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 98fcaf37d9156b5cdd02f8668ab9640bdbb9171cd27085500ef42eb133bd789f
MD5 2ef100ea9b0167ddfd4521fdab790cee
SHA1 cdcc948e80d48f642c33a0183d29d5c45c5b0a93
SHA512 edba0f95de05e065a50fa6c0fd37670fdd11b0daa119b8af41a746b01afbb177bb368e91a9a60c8e117ea27fab33af6d3fce04e4c11f5fe8f758103eedf51785
SSDEEP 384:sxZbpEt/f1svTWvw12aKvWOz/bt74it/Tjg:sjet/fCTYw1hKH/bhTk
TLSH
T17E82E802AA746A7BCCDBD218F555BB53D6F9043392911E54ABFC991C04E7BFD220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5a83e858d53fcc60f7840697ee4b231fce59c62f33fbfeab7420d18f076f35b4
MD5 a303215ef055dbde8d6619c78182335c
SHA1 362210b7bd3d80d314807da255dad4f45c5c7e4a
SHA512 6fec6f20814b613edfe5b37a834fb476446b7377ba8ae0c80babb207c4f458955ac564444a2e121f6a7e8f5bdd6e65304911856b0ca3f29163cc079d9ba3e833
SSDEEP 192:sxZbR7yMwjK1Ml8MFBX/f1sv1Og5Idp3T/W6+WNtGk9GQxSJ/Y0aMsxIIg5bJ:sxZb0dt/f1sv1OgSD/bt0Qi/5/X
TLSH
T18B62F901AA34697BCCDBD209BA44BB53D6F9047392811E54AAFCDA1C04E7FED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 1067310ac09c4d6911d5d754600822a666f8ad15b963c951dd76e2725b873c22
MD5 4a5153f869f781b5feec3cd2a318d874
SHA1 8e48a7ed08119b6109fd7de73b2117d141399cfc
SHA512 33735214dd0ebcc9d8db25de4aaa7dcdf9854df3f020e1ad9786893f4a845965eaf718881b7e53c16ca6202171004973a7d8b6656ec79111056155a332507823
SSDEEP 384:sxZbpCt/f1svTWvw12aKvWpz/btH4iVdv92g:sjgt/fCTYw1hKw/bnVl
TLSH
T16882D802AA7469BBCCDBD218F555BB57D2F9053392911E54AAFC9D1C00E7BFD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bbbce6037ffd0cf90ce2ff86d1bd83446d7a7ab3b83bc80e702bca28f3371486
MD5 3f02f4d4bbd38c09380fe176f144852a
SHA1 2260135bfde71026bdcd4cc7f84050767e8e6d51
SHA512 384117923e7ef37db385d071cb08e6f07b877ae78bd1453273cb9aef8029aeac1a99f56eab9f01f4c9ac08d1455938b011969130298b890c02f330f5fe9cbe12
SSDEEP 768:9E/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0V0Cro9Q:9E/zh8dF2PkWRmEcQXwu1jaKWjLp2tV5
TLSH
T13DE2092F284CCB7E4F844E9CEC266F976ED801CB66684D544BFA894C03C77DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9f63af233da43d5e10ad39a5e13744cca7e86ca6f7cd2e1a781322785e90c655
MD5 b765ff93339e2932bb1146f3e129ad52
SHA1 83b5add7a5f7958e48916d51ad7bef4b4d32ff12
SHA512 fd577d0dab7cb52dcd1ae2129e2aa5a73b9545e4d88726045878bda8f2f0cf8bab4b63944ba2508be47ffaf8e1a280b2ea582fa3fd5d45d5008881f24d5c23d6
SSDEEP 96:KEWgKvLu4KHK6yugKbiYicKPKee7WKko6:2IvnorN3
TLSH
T1C3D1361273BB12123D7F2908D29487574782B2A77014A42B7BA800728DE7E795FFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f894.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f894.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 54eb3fa571aa47fd719d204b0702c23542ffc07d4f66a29efafa549bcd85005b
MD5 14f3280c4e55f661b80951cb5389c0d6
SHA1 852e37a932c5a00ee43ba8e8a361432ab2479ee1
SHA512 5ce988bd4c379ff4fa81a9b57f28ff21c4ddd936efde38faf7815639831dceac55ac09fb4cd6e17e34d9277f760ea74705a8d05e780bccd9ec3efb843beb8cfc
SSDEEP 384:WZcIh8Ny8KpKupbtEnsUOUnF7nTKwBODNZOCb5l:EhbpK6ssUOUnF7newBKZOYl
TLSH
T189927D716C786C774EE6B145F88A32078FF850B7E6992B54D5DCAF1D00EA9981307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fe2a99d00fce6b75ae015c4ddb6ec96ffc872fc53dec9a7a9946ec2020d837f6
MD5 9d9ce8108b7181a6ef66e4d96f986225
SHA1 a54a6a1ddb9c97491a413a3c66df20f3c36e1961
SHA512 2cfbabf8a8ba06b9697c5ac29840408fec11950712e82572207e5285b9b694571b418647b476431b9c61be957a578566b1f3fcc64ea6b1162eff7fb4880a4c59
SSDEEP 384:6iFiZcIvcNK8TUNTUlIl0fKpKupRX12nsUOUna7nTKwBODNZOCb5l:xFQvXwgzpK21KsUOUna7newBKZOYl
TLSH
T17CD217F248D75836CEAEA747A77D2E074EBCC063B5952A50B38C6A1CCC965BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9c71dcd5c0094a201a7e6eb7eea779327c759621b9f734588a20475d0e73477d
MD5 2859a613d4551a844c586f26eceed2e7
SHA1 7bcbed0d1d021b26fe664dd5ff25c97a6c28b166
SHA512 473a78d5f9870101de95cba30e7ec8d2b25c105b8a8542b5a9a64d3583b8d23e8ee776aa313647a6fe47aa023be0fba02a6708557899994b64123c821b2ca5ad
SSDEEP 768:xFu6SwgzpK81KsUOUnOc3nh1K7k3q480rY2newBKZOYl:+632EOsh1K7k3DPrY2nevZp
TLSH
T1C5F25BE948D7583AC9AEB70BA77D2E2649BCD077F4A45914F3885B0CDC2297FE346810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 1a31a46159ad474e32ae6030ccfbf50d7c5c5212a9e0a094a623b005ce6b93b6
MD5 8bb8f8f475c9fafe16c8458035eaa656
SHA1 ffbf37502e2b8f5b3339ec972aa3a07d7adaa313
SHA512 c1667d7ab5d47e2a83dfbe194d79729e9dee3f726bcbe4957534fe56bac5071be63c1730a4dbb71f72ded1cd3c25121e9a4af5d54dba09175458c9ca362ac16f
SSDEEP 384:nliFPZcI6cNz8TUNTUlIl0MKpKu5K412nsUOUnOX86nTKwBODNZOCb5EHx/7IzL:sFH6Ywg6pKi1KsUOUnOX86newBKZOYX
TLSH
T1C7D217F158EB5876CAAE9B07AB7D2E035EFCC063B4902950B3D8590DDC465BFD306821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 26ffd6de653cd4e2b2af185a3b874f43eaeea651b3265aa5106d29edd63928ec
MD5 f84b4f16d793135a0f5d82ef1a477fd3
SHA1 7876c7ec14f66852a440ece0200b9e01c17819a4
SHA512 2862fdee4a3e1747eb88b8d645188bb730ed76ad06e5c6a1352ee7f7ee3cf8bf2fed2cc03c701ff886b5dcc68738eeb46aa1746cf115a81e0d36b511fe1049bb
SSDEEP 768:iFBX3jwg6pKT10sesUOlkDjuKMDG3SuW/ewBKZOYX:0X3PZZwjuKeG3SuW/evZL
TLSH
T161E2F5F189D79837EEAE9387A73E2E029EBCC063B4841A04B7C9595CCC065BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad2485189b7d3f5e2acb39a60360eefdcda1c23725850973e5f095c3c7fdfa52
MD5 ca6205e639edccaa8913f8bbd653a7fa
SHA1 30d81e6ffe72840bb41ffaa646182d8751ebc344
SHA512 701d057f43cd49b3c38ab42c2fe936101d571fe020b1c1528d907388c5964f3bca65ba01132a267355c5591a80688100f3013008ef72d4f1bbac7849bfc54d53
SSDEEP 384:BZcIhcNyfKpKupbX12nsUOUnF7nTKwBODNZOCb5l:JhQpKU1KsUOUnF7newBKZOYl
TLSH
T1CC927DB16C786C774EE6B145F88A32078FF850B7E6992F54D5ECAF1D00EA9582307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aee8b28909496d62c6c9542fe60dfd0c43b38253d679a2b6bd65739d53cd4731
MD5 7038e6f687f7eb00df5f1b82656bf44e
SHA1 ecb162360c82eb49f9a8e20746ed6520cd275e45
SHA512 ed3370e9166e175b6e56a9c8aa29d4b482f55cf5e209ff17342442327a78f4d136efee5853b2b9695771b980e8eec9d21d1776d7d7db537c40224061957e89fc
SSDEEP 768:sFBX3Ywg6pKP1KsUOUnOXrg/Q1KGKk3JuK7newBKZOYX:qX3KBEO6Q1Klk3JuK7nevZL
TLSH
T1C0F2D3F14AD75877EB9D5BA7973F2D028EBCC027F0805914BB9A089DDC1A4BFD282421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d82680d20576d356a5499a067bfa590f6ef855c64e887a19cf31c712b1bd5835
MD5 8ec728fa73427306349d30cdf5aa6c34
SHA1 a783b25715220ac67f11769f72cf4f982eb9c5bc
SHA512 4116793b46e5ab9c4639ea60e2f968ff7a93695c70dfed4b46a474b7aa9d6c1e43f228bc66e1b977140dd3bae235d930e3408cc67595d67fd020f3d2305bf310
SSDEEP 192:BGNHU6P2UOcQmiUyBIUoqGv0UOR1wSh1U6:BGN06eXs6IHqGsUOnXU6
TLSH
T17902D8396C682CB78FA2AE45B88737179FE9107BE9952F80D5D81F1C01DB65C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e30e33d5b9aed44382ef2ff370011a8b06de7dc739e4f506894fddff8df3b342
MD5 8c3898746f269acc426ac5cb4032f4ee
SHA1 e7c690c07902fe07e7c852042e7622c05456b3fc
SHA512 594fe29ac884af0af58584f37d514b36817d13be048c02e62646527c3f4b6b6199f35361951bd00c925ab269a6c4c11cffbd4b01b82baaef820bc11658a77b89
SSDEEP 192:MGND6P2UwQmiUyOEoEGv0UORyno0BJqeU6:MGND6eHn3EGsUOUn57U6
TLSH
T12C120B366CA86C774EA2A544F4C733179FE95167DA8A2F80D5DC2E1C01EF96C234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a2f111e14cccbb7dc0d3e84520c9cb343a7c3f05eb816ea1a904d9fd3a708661
MD5 2ce4bb4b1c1cb9f545cc91170a547bc0
SHA1 ee058576660bfff9cf7b889e78a0d1a1ffefebd3
SHA512 f17602b666a5aa6284d8f71cb20d056c0f63ba6e5a0601553afacfca3c7e5b51713c66e4900900e6fa700e75140555b26b7dbf9154c8d96737396e1055155ffd
SSDEEP 384:tZcIhcNy0fKpKupbX12nsUOUnF7nTKwBODNZOCb5l:1hbpKU1KsUOUnF7newBKZOYl
TLSH
T1E8927DB16C786C774EE6B145F88A32074EF85077E6992F54D5DCAF1D00EA95C1307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 11a9ced2eac93609d942953b1ef93334cb0bc739347b5a688c58c861e7b6cb54
MD5 e0c22b48fdf2386cbdac2ac8a56f823b
SHA1 e6dfe9deea2dedd988320b58082567f10bd3ac5c
SHA512 28b1449567b0a4f9063364a3e272be310cbdc1ad90f063d74849f167a0b3c07156d42e7ac1a41fead38aeda15ed86ad4ad7c87034380517f2e2c14e400ef5d79
TLSH
T10EE0020927060061C008037010831F013BF1C41051E143164B6001A85C633402C20B10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f044704ad85aafdbebe42c26c1a91c1a14d29bd2f27a6173c00c51dbdca09888
MD5 19c3b05a038b65e592248e592f15132e
SHA1 38c5702cf329150be7065731434f57732544b923
SHA512 63875a553b87a8fdf8c2abeefe6ba08ddeee9519c477cf8a03cd299a459ef317c6316c008c1be9540b2dd997d18b992a509e98d48026369447a671df74cc8024
TLSH
T17DE00908A7064022C408037050C31F017FF1C41053B343564B7001BCBC737442C24B10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5209c9757cba6541c33a6d91fbd1cb4d930ebbe1edcf105c69d67c60f9f5076a
MD5 6c8517e66bef71801ecd9a971b5ad1f2
SHA1 8184a0732b864c3fee61c44188887cb867619163
SHA512 f6519c63b4ddfeba5afbf1fbdf8caa787f44cf9873c52bd3128bfdc7159ee7f190612ab9f4c902558de0a01d0c1c2906c0122bb878c787b64b87a6f34d9ed6f2
TLSH
T1D6E0010967060062C008037010C31F013BF1C41052E243164B6001B86C633442C20B10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5b4cc365b15ef55ed22ba49d532b26d99f5af61f57d919b7559a3f8950213047
MD5 a88c62f9169b9eda1e371d9e3bc5c51b
SHA1 f8a817faf35f152cc7d9db4e4769f3cc28ff2620
SHA512 758c02f9ddbc0c99c0131da88ad4a3fa9ef69e7f763556281a58b50721d276eca3846617c3d1fffb9431dab2ca11edda0b41282c98a756f6ebc9eeeaca054e47
TLSH
T104E00109A7060062C008037010C31F023FF1C41053E343574B7001BCBC733443C20B10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce9c0b2d832ea554fbdcbc03f71ebcd505a5c27a66a101e6ec2c8fff841d0154
MD5 5835c16709ba33915522f6555cd5bc40
SHA1 604d1947cfdcabf093e2cddb8b789139dbd367db
SHA512 265d3e27ab39ea44df58cacffbac68bb6440efdb6408bde9490c59842d123d6661c171899c3e4cfd46a47c94265b09bd735c7319fb94655871ebc6bd2c14a6cb
TLSH
T1C4E00908AB468067C408037095D35F063FF5C49457B343564B7405BCAC737443C65B10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5868e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5868e6.TMP
Size 392B
SHA256 fb65c2701d83953d8c0054e5f9eb19ab4a7ae5e2cad3fd6b1c4c9d6ca36060d1
MD5 acf4ec5d72b0e49df9194fd9d00df22b
SHA1 2563647ce00ba6e617488deb10213466d4646c1b
SHA512 1735cc10309daeee09f634017742bd30c89e289c37a8f5c159660f6de5b70fc392e6a541926e75326ca358ad1e6ceb238b503712aa2dd8de833d8e80e1c71491
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
MD5 77f71a1a262c4e86361de3a90207fc3b
SHA1 1c96628f1863ecce746b8e03e244004ff89393c0
SHA512 d32e215753da8220e7f2c1bd8d9b9f882706314869fa45afae698cfc032947bf8759f3f403076a1d8f69bb591edca53da629484ac186d9fd0c6d98d19b36c6c4
TLSH
T19A111FD1183A1EC2D5BE0EAFA0873AFD40D8D626F2E430B918C8ED54567955E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
MD5 a4942446efe6c44ae76e03f049f85743
SHA1 501f2a79ecaee0f14e1e17bbd93516fc73cb8cf7
SHA512 b8cb3908d88cca44b260e44c81f0a093cb6b4c92d9225a93390f336b886fd571202edb51f98654dcb7c80c411f600f090de5af458ffd3adcea3b636210b7b69f
TLSH
T18F1150D14C3A1AC2D67E0EAF60472AEC40C89626F2E434B808C9E854517945E314183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

301af137-04ed-4816-847f-6a5e023bfca7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\301af137-04ed-4816-847f-6a5e023bfca7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Uninstall-PerMachine-2026-8-2.155.3304.1.aodl

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Uninstall-PerMachine-2026-8-2.155.3304.1.aodl
Size 256B
SHA256 b45b7bd9600fbaf04742d9e3d81750d8521f70286554f312c92b108580ae8be4
MD5 a086e8a6483735c343548121c7a9443a
SHA1 adf2789280871cd7531f427d25e5ec2d63ff91b7
SHA512 8a438f3dc38bfb787556e9d6d2f18d9f94a3ff48a711561c3cc3d74d80252dfa6001a11d41639bf59058a4acc9e049626b066c865596d04d59f73d8faeb83337
TLSH
T156D002504E231B50D58110306868E22474B951DB51408C56010F05208D82650755DC64
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 3d7b89078c7d73719a036fe5d3a81c95bc0cc1e85819d16629a2e256642be658
MD5 3e910abfb4018e7d1a8584700e575e62
SHA1 55aa307208a18dae487788ca718797e78462fb35
SHA512 3a8a4ba87762ff169fd2ec92779bef4cb9315fd6401ba77fbda04cdf31d1c2d5625110d45d5c5a820c6981fe1fe7aa82ed1e211b54ba31169c6bba435e35ebdc
SSDEEP 96:gi6EkreKBtuZA1RIg8tPckHU2xG26qjHr3r4AoGIoNRhDtWg6pqqo:gHE5Z+8ekjiqjHr36e7zhSqqo
TLSH
T10DD2CB66F804D662DD496C72EFEBE5EC62327E26DEAA031739C1B73F09BB0C00854548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 986df0b82090bd8db90225595573ad2ab2ea538a2ec689c5e9baaee61d012332
MD5 14690e484b5fbfd0eb7d5cf934f7ab12
SHA1 17a48ec8ac01efbda53b290987c9e77feeeb05be
SHA512 2e64571425c14902e261da2ee4cf339bfadaf417cb9690eebddebd4f51329b4bbec1b8e236d7579886d2e8e2024e7bd7cb35d0b0d937d62861230cb203b14c8b
SSDEEP 96:6i6ERrexBtgZ051JIggfPAOkHU2xG26qjHp63r4AoGztoNR1DtCg6pqhdco:6HEVZ03gxkjiqjHp6364K7fNSqYo
TLSH
T1DCD2CB62F804D262DD096C72AFEBE6EC62323E25DEAB031739C1B73F09BB0C04854548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 7ebcff534a95c15fcf35c92380abffb01ff0a91b4a534ca7cea363d4c9123242
MD5 78e0c0e8a0708bc47f41f15d5b8cee5d
SHA1 64177751fc7e900f455216d9c6e38c06a5aa0802
SHA512 d31cd22381b773e59746584043769cc85f1cdd0d247518ba4a35c308feb5f7925dc73fca1d6a46d2b34c36a53a4e6b217a28a9b0635ce6b58d0d92f53008962f
SSDEEP 96:al6ERrexBtgZ051aIggfPAOkHU2xG26qjHp63r4AoGztoNR1DtCg6pqhdco:awEVZ0mgxkjiqjHp6364K7fNSqYo
TLSH
T101D2CB62F804D662DD096C72AFEBE6EC62727E25DEAA031739C1B73F09BB0C04854548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v1pny25i.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 d702d0163bff5a1ab225cac03e68b9633a549089fadeadcbf964aa7e38c144de
MD5 76f1e5b2f2273441402430134116d37a
SHA1 527b3b6d1ae7fbb096903243cd73fa466cb3bd90
SHA512 b4fbb5a60b351bc3a60a77826c704f3da8d617729126efa18eae5967eb601df9c81d1d46778f7f3932950520f09c304663becef1e79050cd8fdd6855f07a673a
SSDEEP 384:HwCe7iO024YZDL84KKDL849B7SOEAd9KVRaAcP+AWRMAtl1:QqZYZDL8lKDL8CB7S/AmVAf+hRMOl1
TLSH
T10D729E799F413CAC29A7C0E8C0B952D94D18B7A3DFE6806D21683D0DC798A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Size 32KB
SHA256 684d8c75c6bd64c276b318c3b4c25d8459657381f12027980078c030729e75f6
MD5 fa1d1ee52cf8674da1d2190adf5c3c59
SHA1 82f3f77233781c9495d3f3c21d9bf90edd49f967
SHA512 079f23023aa23ebc6a0b81ed786dd0526fcce3c0712f55ef3d2ab3eaab4ad403bccd0febe4a0162826bfc90250b8a56abfa9d4c196a5d8fd5e396b046c29e74e
SSDEEP 768:uU1EKos+GDa50f8N7F6CjUWkuc4poYAVfcaVnwSYQ3l8RJf:4Kos+GDa50f8N7dUjuVoYAVfcaVnwSYD
TLSH
T142E21A343AF51715F3F29F759AF56A9A683AB866AC00DB4D0162024D0937E93CD70F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trans[2].gif

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\K3CELKOX\trans[2].gif
Size 43B
SHA256 b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
MD5 325472601571f31e1bf00674c368d335
SHA1 2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
SHA512 717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
MD5 SHA1 SHA512

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 3KB
SHA256 d229491114a8ced1e78c65a5c077b58f8ce9ad832eb5532f02858b7e2dcf3a27
MD5 9b9111f48098b85f070f796cd7783d2b
SHA1 e9200c02b68b1fd4f1b6fb231b4bd3049c955264
SHA512 fe2838b2a0876dba6d8ad0e8c5894e1d302f4ea49ef10519b8122763f7e7b5c584c876765bf0073f5e6a48a8f48ca0d139a23df29187b50cf387cfe7614d0088
TLSH
T1DC71506CD5F34F2E6C1C7039E6802798A7DFC31BAAE837F91C5C3EC926489086A17458
MD5 SHA1 SHA512 TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 106KB
SHA256 41b4f3892225759c20def807ca68127176a61006de25d334dc07422f0e2e4b9e
MD5 4d03078499c53d399db89081d8c824e6
SHA1 ed3a68579f8b69a3e80681df5f13de4bdb975db5
SHA512 82ed5859c2e7a711a14dcc8271cba55ff069ad0e989b9d6e8ccc446f61a08ef31d0f4e638286f4aa9c5f33cf3346c8dd3036b4ea32c2d465690433b430ccc9e6
SSDEEP 384:whDD/EZQHJePkf/rq4g+RVvJN9nJ30Pbi/hXZxH5QbCZbO8zchZV6g0hpk7X6sEd:wyMHzMO8eGd/iWtrciougCNe
TLSH
T1F6B36869D2F346BD59AE3AAEE1206F7B15CBC70B67E437F65044498E0E8426CDD030AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 55KB
SHA256 02a5fe6d261ce5569344e079d069f6b24757a1be110a87a9c0a627451e231a3e
MD5 f7fff5786459d0bebbeda4f705b027af
SHA1 1deb590764e858629331fd119c90fd8fbac7dd89
SHA512 68584e00ca9d9b34b65bdf0242852e45e8fa9e8004051ac4edae804b074335c52a4f21024f6407e21966e33dc9330ee1d1b4fe214f29016c701db1edad1964e7
SSDEEP 384:Rv/AweWs/ft/1/kO1yqo1VWbhCXbmA9eJkvIL5w+tA8NKkicdy6iY/ZEI9VIoLkF:aZRaRLl92N/vZp9WCONeySEmFLEXp
TLSH
T127438779E1F38A7E847D3A6AE150AF6A16DBCB0B27E53BFA5014449C1F8425DED0309C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 85KB
SHA256 1d2b3ca7be4702c564f219ad2f2d7ead60d729a18a6b247e99c6639b63f0f828
MD5 7a42b1660c9338ec66dba56748577a81
SHA1 26f70e0d03a81d3c8e7b7338ee8bb68fe34cabe7
SHA512 5e4f7b8f1e9fa7b625150820416f040219cb440764f824856fbfda608bced086eaaa4f05ff26f76ade768a000c70425cd50d754077e203635c1ca163104cbaa4
SSDEEP 768:bxfqu+82bDJuLnQAl1auMKUKNmfV7ggUXPe:bJqu+BDJubQk1auMCsfV7ggAe
TLSH
T1A483872AD2F3467D54AD3A6AE0206F7B12CBC71B6BE537F64050099E0F9426DDD031AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 51KB
SHA256 90a41d6da836b0a0b0aeccb59e9fe0bba8e362b2a5bcfa1c2adba5800e25cd54
MD5 436413eae842f53769ca9620e5b2efc7
SHA1 2f1d14dd15deed74b89768e4e0831ee452635b70
SHA512 590518b64ba8b175d30e1f2ed1fc59f55b0a52561beddf69737ed7b533cf14555eccd5345119ae26f7123db028ae548d2e339ebb9bc5c9037d4789475d388853
SSDEEP 384:j57aD27uDQitq4hLrAQKcs3k06Lhw1tM65kykdNk4mc+AlUlhkHHjob4UyiovK9Z:682oaKU9gUX8Yq
TLSH
T13B33212AD2F3467D25AD796EE0206F7B12CBD75B67E437FA4040598E1E9426CCE031AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 117KB
SHA256 5f22f8afb83d5856619ead1e2c62d06bd7de86e37080e90e9c0df8af695c8e89
MD5 8e3af6dc1305f68161b0cfb1748de71e
SHA1 6fb6b5687978eaff350c1457b43ed3fc9888235e
SHA512 c80a0982af14882ed80e59cb70965e06883a30ba9878b6bb9896bf2ea0066f48cda62111c95b9a91e8f3b09c83c564463bcf4673a25885f675b7f0a4cb82f470
SSDEEP 768:rkX7aEiljxF78dfjwz76NmYWhKWaGmcTdq:rkGEiljn6fjm76sYWhKW+Ydq
TLSH
T1ABC38579D2F3457955AD3AAAE5107F7B16CBC70B6BE43BFA5440468E0F842ACDD030A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 140KB
SHA256 307ca5d7bf5eace74afe59a4c90a61bff60b8ce34c26a573ac996c77507c4df6
MD5 5414df283cdcdf6469f9fb71486f2cfe
SHA1 5ea154471ea484f18531ad5ea74d9b5590531d8c
SHA512 241a244b65bff844e12e5b561f8b79367524b5108a38b58a261cfad6010b9a296641bf64c2e8533c1f32a42bbf71b8bb83a7977544cf488205ec1d8185cc4f46
SSDEEP 1536:rgVqYMiZjkhBubjVVHv6OBgMWhK6ZHFY29bJc3m:rgVXMiZjkvubjVRv6OmMWhKKlY29bJc2
TLSH
T119E3967AD1F3457A556D3AAAE5106F7B16CBC70B6BE43BFA5440068E0F882ADDD0309C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 2KB
SHA256 f44b2a9b67368183f877a425a47828b1debc325b736ab5f3a13840417b7744c6
MD5 c73b16191a4861a940a54625326b0106
SHA1 c414e098b6df922c46aabf4fc230d0256a9754a5
SHA512 ed6c1e0c06ec83a0790fb0dccec128426dbf31e16b42cb506972327c01bcf2b8e33629f14efca99ef959dfa0fc10082656f5e0d79bab88bcda2094e3e563b515
TLSH
T183511B2CD9F34F2E6C5DB47AE6843798679FC30BAAE833F81C6C7AC463489081517459
MD5 SHA1 SHA512 TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 51KB
SHA256 0dde103c199f0cbbc030bf6cdabbc545abb50d6e1a8dc66888d9fac45bbe6c8f
MD5 c1ef7359ee3873ac557bd72297f94578
SHA1 6d8c626cf3927bb096edc9ecb51ef2da0e537820
SHA512 ae97fcc6a83680172b667ac60c1984f1f069ce738c4e2da7284817bac746987a1430fad6fc1a624f8f033f946d4892050f54a101cce3652f27466bbd4a6e1a76
SSDEEP 384:jrj/Lz2i2hb6Jyr5rLzjiuregNYrTeo79LXnBqWZA37alHO8ztv7vQPR/6NzxiIn:jrBw6cr07guriSZS9FOkZrstUE
TLSH
T11B33443AD2F3467955AE39AAE1203F7B12CBD31B67E437F64044498E1B9821DDD030AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 94KB
SHA256 860e7496e5b22267e8971df94d11099e7d3e36c78f8b20fb661eaf09129cf66c
MD5 8c7c2bac69f2cb3faf32905ab504ad00
SHA1 14c0b551b36caa64f16a9ade4febaae1c8d46c3a
SHA512 0afe425a99c952326e77df46d76a760c423e7762bb203ff64f1fd6f3e837851fc69b93d7083eb18e684cb925912e409a1ee562903bd79bee45eb308948a21c05
SSDEEP 384:AwStk/aynsM5tX2dD/24fxCSSzxA1nBsLYqSSLYKqvsLYqSSLYg+mMUMj7qmcpVh:ARbfEcMNvZ/l2sSa35+Y4uLv+YNCwh4E
TLSH
T1F7936179D2F7417954AE7AAEE1106F7B16CBC70B67E537FA50400A8E0E8826CDD430AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 147KB
SHA256 0edceb7f7979b9cd9c948db375b927b427eff8afdad27b2d5e622d938e38d07f
MD5 e11591b57fca149593dcf1b537c2ff17
SHA1 7fcc1e4ac2166ead85f0024b1035699e42603c05
SHA512 24f61c4aea4123016b34a1afb06b02615a89ffed7503de5168ab7cab03a7d4faeef91df152d52d79df4ffdc10804c3e47d3d207682aed69693a81a08c91295c3
SSDEEP 768:MswGjtN+NRtehiFVzTzadzwkFk0jKpFdLTO+swpdZTEJGAqo:Mszt4nehkkmcOT/O+swlTKGAqo
TLSH
T1E4E35279D2F386B955AD3AAAE1106F7B16CBCB0B67E437FA4044458E1F8426DDE030D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 5KB
SHA256 a20c9b8c69f281408e9f748611a2cf2abae6cce4d6f308252275e8890013b943
MD5 0365bb8316d4ab42062f86fde7b2cd12
SHA1 a9790fc20cf8547a007aa008bab5399fcc8cab5c
SHA512 b3f616703f71ff1bbcc86727ef049417d7e3eaafc60ecf902f0fcb38f4ed04ad2bd3e17cfa2ca4b74b16eda196c556cb415e9a4277709d9d544ee2abc9c33c92
SSDEEP 96:GE6aTuOkEl4q0kB0/2lO0xjagtljYMNSG7JHG6aRRZuOkeUlClYnG7MHHYakekem:j4kCaBKlkuXUH3kekekekekekekekekf
TLSH
T14DC1F16DE9F31F7E6C4C7427E5803B8967DFC30BAAE437F8582829D82358A4D2903094
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 20KB
SHA256 4c166fd8e753be4c0cc2e14735d7863ba6b5a3fa7ef89ead352d4fcc45b0bcf4
MD5 8e708644382283dee81ce4d98a85c180
SHA1 e0633a1ab351d3516133924d79b8b61224b58eca
SHA512 3a6ef39cd71178115403096c3e9fc6ba78d8019c02a603cc10e50ef9568f34b8c42daa065afedcff05f06a798894fdddd3e9e74ed58375d80a1b9b33cf8d4163
SSDEEP 384:vwLCfGy/Q2pUCWSrBj/9XrKPpxq9ADbFO:v9pebc
TLSH
T12BA23F7AD4F3C97A847C7569E240A76616DBDB0B67E43BFF584864981F8820D9E030EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 5KB
SHA256 b988888ba4f45664729254d50b7295a51927400453290918e48ad4b0122cf8c1
MD5 78ae1c4d8f0fbb10d540b4d97e3fb3b4
SHA1 f13bd6393d5eb7c01b1fceab2fb3f8c5ef6ec999
SHA512 fa873dd5458838f70edb59a102efb222b7d4d9abd82ac96801b1ec13915768c124b9d04e625626b2a0f1c36183e4333a550465785b3e3dfa880b2346ecfac6aa
SSDEEP 96:GE6axuOkERcgjhsrYGcsjZDclrSG7RdHa6aRRxuOkeUE3nG7iJHKakekekekeken:NcgjhCclBnuNCiBdkekekekekekekek2
TLSH
T12EC1DF69E9F34F3E582D712AF5903B8957CFC31BAAF477F90C6829D81788A0D6913048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 99KB
SHA256 46601d67f2bc869f9e758aa1199be16b64787361bae378f8cf5b00215c6a1d38
MD5 fbc8200e38a0bfef912577a02251911f
SHA1 cfc58e391b0f66cf62885dcfd9e6308b1b8647a2
SHA512 d144ac16740f7549e34edee52cd21b696f01d0f5e642c5c581a35aeb1a46a529d6ad73c724ad5b88b025601e46b427fdece701a231319a6a3b751ace7a84a74a
SSDEEP 384:p/NNxw8Sk1hmYOSq+TsdUT2plGyPxXX0hIt/yhrw8/Fb4Tqi84xQ4hiVhlcs28XR:aDBnWTnbvS3FDTLGZPltS10TeW
TLSH
T1C2A37569D2F346BD55AE3AAEE1206F7B15CBC70B67E437FA4044498E0F8426DDD030A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 137KB
SHA256 1bc75264b27373152b28de6e522840a35ad2c9ede048b4d2af55e1d1a89f7b38
MD5 b33c55d23dbcf03be4cb4e9b90ccc22e
SHA1 9c8b0e4a35f54f86807843dfac58be3445dbbed3
SHA512 27a6125f44627f3533a5c818f54ba167397abdeb16d4090a869357ba25a8eb313df38acaea355edc2269711567625553901c8f533031aef9ef772620c5c95e42
SSDEEP 384:53XaZQZbdKws2BD84rjmZSgXPvwqP1nCsvckhWBQpG1HFBXJUJ7fJqC+Er3PVbC7:VKSs4o47T8hq+Lryl6Ih
TLSH
T193D30169D2F74179E56E79BAE0202F7B15CBC75BABF437F504440A8E0E942ACDD030A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 193KB
SHA256 8fb7e03ad846db6c66fc9974c440b961d8a1f7db0dabb36899336e10c7ddee08
MD5 3fe1ab8cd0d5d1c81f8252a3ac40293e
SHA1 7d411a37a9f3eae550562aae8139c00e5d16e303
SHA512 6de2a67ab86afc4733181ebaeaf9aa710d1db2ea5d3140d98337a73ddc75e90a99bee44b2766add245cea856bf7421005f6e35cbcc98face8abe1dcb6547bb54
SSDEEP 768:trr4O+YY2E+0Vw+YK+U4D+R448+ZV0+YWyH++RRc+AZ6yK+QLjNKlbN5K+bBbNY0:trr4dVUU4M44pWWypR+7mLjNKzX3Hwg
TLSH
T1FC1485A9D2F341BD15AE79AAE5202F7B15CBC71B6BF437F640404A8E1F942ACDD03099
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 5KB
SHA256 0bbb8417df1e62b292d4ced3148ea653131188c184491e85757dd1e48a21ed75
MD5 8653ca74cc64898a1c286bf41e0cab86
SHA1 d917782ad2b0df21e0d587df87fea00c6a2265b2
SHA512 d96fd369a0938ee52349ffddda36574f762da0566e4d1f6bdc13b4edfb7bc3e4e2c055840e11f3f4588e84c05f0e8b8d73b7a52a32223cf5750d2d5da70b2ba3
SSDEEP 96:GE6azuOkE89aLZHjiQ0ZMNSG7sHB6aRRUuOkeUFDnG7gHu/akekekekekekekekt:uGp+da0HON4uSkekekekekekekekekeC
TLSH
T1E4C1E36DE8F34B7E5C0D7465F6A02B8867DFC30B6AE437F9886829D82348B0D2917194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 274KB
SHA256 a49b92adb51aac480d5890dbf27a3c58076ef6896ae18a63254e57de52f1600a
MD5 27760715c5c175eb61094c6b6d3f4534
SHA1 7403aa5086af971a73a97ff48c29ca3e8b92c223
SHA512 240e44716a75948dc75b4c9c7179287b76236be6afb93890eca6021e4a8faecf96964551b5f98418846a9b27dab37a81cceb5b734887e11d1efcddfe6e903370
SSDEEP 3072:ucvT61lcgGHt8/oZA9tD/eT858X06A4Vh/lox1nQWV:xOzLxgifRyX/AK9Sz
TLSH
T10954436DD2F741B955AE7AAEE0202F7B15CBC71B67F437F640804A8E1E9426CDD030A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 106KB
SHA256 3e6edf6d4860320c5fab6d4acab2199cdfc551c8599501eed8e302b13c0ea3a0
MD5 2d71f0fa3b868ac8c4958c331c83a75d
SHA1 038f0ac8e1e84ca4c1e7b0358e32207bcc8f3476
SHA512 a19c8062873c25915755cff7e6d9699603db8905378ce7ebfcdf74fc2dde7648c003c08f9d64a35f32aa801d072bf3d253af5f601140a3ead2787f0cec0e344a
SSDEEP 768:VeK4iOF467BN0l4aaRFZy+Y5uU/+4cGn+Y41clT+Vn5:VUtF7BOl4amZaoGYclTQn5
TLSH
T174B374B9D2F3427955AE39AEE1106F7B15CBC70B67E437FA50840A9E1E8426CDD030AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 5KB
SHA256 b2abe59c6367e85291fae9d4476587082db57e5ea0167413bfa465cd1d3caaaa
MD5 dacddd9b4bd313fc99c80f6dcfe01bed
SHA1 697276afe878e51c247ab2ca7cd44f6719cb723d
SHA512 e7849757eb20f002d361a2608ee964b9a29b7a7d5940b787486d63d976abf355d49c3f9f3844ab90647543f630f1082bfb6ebcfaa8033bbc29f576cf16aff4ac
SSDEEP 96:GE6a0uOkEsoMuGvPu6z6iuGvYI+LzjMNSG7BHI6aRRbuOkeU4NnG7xHPakekekew:Tlu8PuNiu8aap4LY5ikekekekekekek1
TLSH
T1D4C1E46CE5F34F3E590C742AE6802BC9A7CFC31BAAF577F9582839C8579864D2903058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 1KB
SHA256 be0971780242c0a705335f4b6d2e7ffcdfa5465711854cd12bf4168b80c0fc77
MD5 6b4c8a22c5c5ec071f5c00ab19f0cabd
SHA1 5efc64678b1fbc3ee761b5a7a4a04f6997c1aa7c
SHA512 7674719de6815ae84c9689b7ec509231e4ec37c4776107bf17cac739b19c2386c8a6908ece40d5e9ddf524327b2c5a24efb5541464cba9940a17c51c032c8789
MD5 SHA1 SHA512

Submit Download

www.bing[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LOW441CJ\www.bing[1].xml
Size 65KB
SHA256 3bba84791526ce78210b3690a806d8f6510365f1cbb3268eea4c9e8d089fdd53
MD5 f4d2a397f693ff3896a3c16eff712043
SHA1 f0e840baa7b2a8e09df7ccd49bfa328c827a7eb3
SHA512 557e5350d8f74449e874d8b79e2d6014d8bab396aba939c0afb85f7be28267ac025359826f52c10ceb38a002e620ca8784c9a93ac4ff4da4fcb91050e6b84257
SSDEEP 384:P/MO7nivE4rKzzZSiLBOneHc7JqP1xiyqmajPwXX4gniC9C3U+RXkEn1/r2Ba+M7:PE2n2uHFiQu3U/cDf01Dbs
TLSH
T1E76386B9D2F3867954AD36AAE6106F7B16CBC74B67E437FA0480458D0F9426DDE030E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apps.ft

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3d782b9a-2d02-4e16-8baf-2ed5d566444b}\Apps.ft
Size 26KB
SHA256 8cd2ed57bd2e420d5187f9b0fdca870df83c97b3a3310c6042c857c28f6033d8
MD5 92c658417768a7369b75d98ef5c4ec87
SHA1 dc238f005368f31f907b34ffb24568221d680395
SHA512 f18f00e8fb9232640ac59bfcb7cb23ef71685d8264210c60dd31d289b0c2a2c97fbb87d255513f7558b0663e4e84f5e15c1714e905fe70b705b000b05df940d2
SSDEEP 384:mXEda6iqtexqNJKKntV0gFh7ubFX0z36g36+5uCBMi5Jjc:mXE4qec+u0DFyTp95Jw
TLSH
T19BC2D8E50738976FF3062F394292A430DAA4677190E9F3C7DCD935A81DC92A24F3D64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5d1deac7-48ee-4da2-b20c-cd5b9571d1ba}\0.0.filtertrie.intermediate.txt
Size 20KB
SHA256 905f3a582da78a2c32548afe04095c76cc6d851d4f0c233140aa22183860f178
MD5 5bc90882f770819f281d74ae44a6c74e
SHA1 7cb5224f5a9e628548e920dbaf4754e77f07698c
SHA512 c3f44067f8da121797ecc10d8f768cdf37b7b4e45dd241c545840ef9462f34613ab39bb075083f8f08d05323d5cbb817f75346ea99e747b340d6f2c33f65d716
SSDEEP 192:pK/qmSRR1Atblr8l44dE7WaFKJLj5GmE2JKwzUmg/SA6eNbLi2ajO6gpuUg2tUKc:gbal44igJGEtA1vi2ajO7gL42/g6gOD
TLSH
T11A9221338674A2BD74716BE46B038352BC55C84287876A22175E7DE4A0CD0B6CF977BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apps.ft

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5d1deac7-48ee-4da2-b20c-cd5b9571d1ba}\Apps.ft
Size 26KB
SHA256 ed7fcdfdf79eb977979edf85caff3cba98d67af845243dae82ab2c5b23e283ab
MD5 48d1f5be8b7930f3ac758c0ba9c1d8d0
SHA1 da313914c2189e82cf3e5483bd413917690872b6
SHA512 7b1faa3d2e8e0b7a04c017763ff24824f899dc9021787542fd5a36a86011b2e8cc0e52167bfed3f90afa19ede6581b9b4a2d77e67841df8b5aa074f7f0deb9d0
SSDEEP 384:vtEWa6iqtexqNJKKntM0gnh7cbFX0zxvg36+5uCBMi5JjR:vtEHqec+j0rFyIp95Jl
TLSH
T1E0C2E9E50738976FF3062F394292A430DAA4677190A9F3C3DCD535A81DD96A30F3D64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apps.ft

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{649a3e7b-c198-477d-8c70-2da480e001ff}\Apps.ft
Size 31KB
SHA256 81be3cfde926ceef1aa481b70c3c4359a2ff5808eeaa9de3add235ed19e562a1
MD5 0842bf60f36ed0a0fcca1d5293f25856
SHA1 2d67c5e5cb3ecf2ab270392244ae214661900e97
SHA512 cd5fc52768f563805882ec4bb231c383cb83bf468990c0ff638f9f23adb44a6e99e354f8a634c34288de795dd30af8f3ecf34f1df14d9d644926dc2d4e2d926e
SSDEEP 384:8QGE9x6+telqWJKKtQt9Qj/X4FXLdcwb8g36+3dbCBMeEAWqOq:8xEjTeY5Sg/F7aydCbjWqf
TLSH
T131E20BD50739972FF3062F395692A434DAA827B190A9F3C3DCD534A85DC92A30F3D64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a2ff4421-6b3b-4f58-9a10-e2588023ba1d}\0.0.filtertrie.intermediate.txt
Size 23KB
SHA256 4e4568549155d9aa8943cd609e86fc2145a141b20adebd9e9258ce00a9abbd53
MD5 fcd3286dc1951764c3e671c69cb74fa0
SHA1 420c03d8b1af1874df3640b09bccd99f44a5aed2
SHA512 0b9d2f49af67ab9adf38a8a7b165da63719ea747a19a08466f47dd03134d84b43b51fa23f800469aa67891380c69dcf235783db9a3994c579c5ea540a0c88005
SSDEEP 384:vVkuus44MmJUGC1WxH1EkwaRct+iPajWcgO42lg6gOQ:vVkuamJNRq+iAg3Wj2
TLSH
T12FB22F338634E1BE74316BE42F03C352BC55C8829787AA521B8E79E4A4C90B5DF9727C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a2ff4421-6b3b-4f58-9a10-e2588023ba1d}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a2ff4421-6b3b-4f58-9a10-e2588023ba1d}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
MD5 c204e9faaf8565ad333828beff2d786e
SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
MD5 SHA1 SHA512

Submit Download

Apps.index

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a2ff4421-6b3b-4f58-9a10-e2588023ba1d}\Apps.index
Size 1016KB
SHA256 60891c53f0149c2650ffcf69c7627ff1fe724173156ecbe07cadba44faa00122
MD5 ebf8df905c60c4c57b1c571477e84d18
SHA1 3533e1ae42c4ddc7636e753e9a9aae0d26036afe
SHA512 09bd77c51582a0cee2e9d9ee687e9f376f7218499b324debb88e3c3d9d300435e4a5936f540931594fa454b44c6d0831afc91dc0c5d63cf1b5bdc6dfb4195fb3
SSDEEP 12288:MxmthXv3zrLoE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSTa:AoLr7YfoyFxz8GfoLr7YfoyFxz8Gkl
TLSH
T17825F0092F90626BE8355BB42FC32F027FBFC61953AB53AB9A35413C1CB43497D5942A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134301093168550701.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134301093168550701.txt
Size 80KB
SHA256 436f5669837eab13575a223482f807f89b249bdd109fb292e56b6a1243dd6f61
MD5 4c270cdadfd6c3be39963ab37e925324
SHA1 b672896465885a60b072c69b9cc0e1079eb6a179
SHA512 4b04aa418099e1c295600196157c43c91b0d7107f0dd59b7ae4c5e3fe018cb1726c1597bf22dd4c4a91db577e0d204b85d58fff33c78fb516fcdd71abb7afe25
SSDEEP 384:MHMhUlfi+WAgeFzAX69SzTl+zPh5WOvXw9QZZHPpgm0ymshfw8fdjZiTUPvqmG2v:MYzTl+znpIN1fBviKj5O
TLSH
T1C383D9A53280CBF6217966A4B8CDF525F12D27B1E0A88F40A5FB9116FD5ADCD22313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134301093177880577.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134301093177880577.txt
Size 78KB
SHA256 d7d83f2e1700b52bbc1080870055f3e1a5e3c69e77b7f512ee6ccf0304b7ccc8
MD5 042d3da18fb69dbbc2cc5f838f370dfc
SHA1 d871b17e90eb08d0b5d32c234736a8b3ae67f1ce
SHA512 1125e338d507c7d07b279543f48526b4e3e3db9f128ad302994d9a871bd1c4c8877a71507bdb6a3ce4139a91af33df844468d66ce17eda6812f8b713d3fb7a25
SSDEEP 384:MHqUlfi+WAgeFzAX69SzTl+zPh5WOvXw19QZZHPpgm0yGw8fdjZiTUPvqmG2vIbq:M4zTl+zepIN1fnviKV5O
TLSH
T16773C9A53280CBF6217966A078DDF525F12D27B1E0A88F40A5FB9116FD5ADCD22313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134301095694594400.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134301095694594400.txt
Size 68KB
SHA256 5cf6661aee48c2de502cc6c0366999c280acee3a03f08387944984ce248e9d8c
MD5 64b9e07d5f4f5e3c1a70306c2ff6039f
SHA1 aae0a88a39a2e08ba47c54f7dad3e7a37b803e3f
SHA512 b75b4983e667d33581ec836b50f8e838c6f8b0b2027e249b3b763d2a75b5266fdfbc476350bcaa3b75f419666a7d43d01f84aec6cea113cf8a443f010704af7e
SSDEEP 384:ulfihHqJFeFzAYzTl+zPhPim0AYZVUFJbOvXw19Qi2v5lNg+nZih629KfA3u2tIJ:fxzTl+z5KOpIN1fEv15M
TLSH
T18863DAA53280CBF6227966A478CDF525F12D27B1E0A88F40A5FB9116FD5ADCD22313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134301096033910291.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134301096033910291.txt
Size 68KB
SHA256 66d2ebf5cc3319ca6ac9f08382e87b412846a91b57772323e8d5899c6ebc2b2f
MD5 78131642a19d107cec840bcc60dbf546
SHA1 bffa3547acdcd165a8b5abba4af5e3c9c42f93f0
SHA512 cad626bb8d525c864b0434f55ba434a6e137f520cc23e1a38d529cd49492a1aca4f807e391ca5694596aa9f100ed4a8b9f8d192cb39582c16ba661f9abd2a2ad
SSDEEP 384:ulfi09HqJFeFzAYzTl+zPhPim0AGUFJbOvXw19Qi2v5lNg+nZih629KfA3u2tIbB:oxzTl+zDKOpIN1fGvI55
TLSH
T11C63D9A53280CBF6217966A4B8CDF525F12D27B1E0A88F40A5FA9116FD5BDCD22313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134301098505714756.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134301098505714756.txt
Size 67KB
SHA256 7b91d09091cb3eb6177807f9382e02ca74baf4a83b19d372f48fe0790d88d78a
MD5 3c798de272a301b8397cb9afd2f4e9f8
SHA1 8cb8c4eec49ce47604a0aca35ba7c351a337103b
SHA512 7f50a6a991025aa9d968a818be680bc0a7a83a09a1821ad289764d7c152c4772d0f7888e81219d9d49c7ef36c142afd833c6e2f0e035e0ed83dc0263676750bf
SSDEEP 384:ulfiEJFeFzAYzTl+zPhPim0AGUFJbOvXw19Qi2v5lNgvBlnZo629KfA3u2tIbope:FzTl+zUKOpIN1fGvd56
TLSH
T1C563E9A53280CBF6227966A478CDF525F12D27B1E0A88F40A5FA9116FD5BDCD22313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 0bf3c5e32f2b1ce52874794311f6cec339c8a8fae483f599ca000192ff8096b5
MD5 10207ba4e1d95abf1bf9354a93d36d18
SHA1 fe907997c2b44b4252ce6bed1a05ab405219421c
SHA512 864b1c94a6f4e1e9517363d16d891ce96e9c04e770359ccd281dd2e3e1a8eb58fe98254cac6085239063038988f328a93b07ae0e638adcec00f6bcf6779a3c7b
SSDEEP 384:y0+JWJy6Viad2kHP4mG9jUWr5mlUrddH9JFQSJoJjU0+GDa50DKaYAV6cq3n4YXg:Rm+y6Vim09DbdcSJ+jU0+GDa50DKaYAv
TLSH
T1D2923A743AF51319F3B69F349AF1A95A643AB8666C00DB4D0162028D0977E92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Size 27KB
SHA256 10d9fec7ad09e6a55045b6ea1567d6c7d9e44b5cd7551c1c6c11c4ec322716e5
MD5 271e001b103c8c26bbbfee9725d8cc4f
SHA1 d2b8dcfa225cedad0c3ff154f28995876e4c0f58
SHA512 b710edf12e60befb4c385d0f6c55f04d010a9c65794515116d62bb79834abeb3b53e112a11e829bf2b1d3684fe066947306bd016352388780b6c7311789685c8
SSDEEP 768:aSUKKywcKadCjUN1OmFYAVfsSV0wSY2+GDa50wLhl8RJs:cKKywcz0UnOmFYAVfsSV0wSY2+GDa50+
TLSH
T147D21D743AF51715F3F29F758AF5A99A683AB866AC00DB8D0161024D0937E93CD70F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 20KB
SHA256 405ae663074d7a597b713eafe13bf164ddc7b7d286af4100cc6aff2989a8c5d0
MD5 72009aacb2ddeda5d0219ee853923902
SHA1 cd46eb39c4a5726c5117185214d6db7e101f33de
SHA512 d8084718c962ebba1c810e2ebe595492c70e6c93c13ba8558a6cff4f6f255f9c368992103ba8b9964d182042286567ee53a94e74c8fe3c0efaee1faa426da254
SSDEEP 384:/0+JWJ06Viad2kHP4mG9jUWr5mlUrddH9JFQSJoJjU0+GDa50DKaYAV6cq3n4YXg:sm+06Vim09DbdcSJ+jU0+GDa50DKaYAv
TLSH
T191923A743AF51319F3B69F359AF1A95A643AB8666C00DB4D0162038D0977E92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrtact.dll

Path C:\Users\Admin\AppData\Local\Temp\1335659677\Microsoft.WinGet.Client\net48\SharedDependencies\x64\winrtact.dll
Size 143KB
SHA256 f4a40cd96004b05ca8f22958b996d3041a4722aa02f241c95180bb8434e7bab9
MD5 eddac67ca0c65c568bb5b60c72941ad9
SHA1 0bd45d5a9308485c92975e761eb250a8ba187f33
SHA512 692023fcbe2eefd46fe34123ad9f19056a29d58663135b308435fd844fda63ee085eb568285003f0ca810ba79c37d9e05cb312879b9ccc55680ef86ff6854e25
SSDEEP 3072:op5L4NFI/vx2lk+ewRv5RYMPL61DAtTKT0806/oE/RxSXA9U2jjILAz4bgt9tddh:op58E/vzwRrLyGG
TLSH
T1E0E3392273A840FAD46A9178C6931E46F7B2F49D17219BCF0261C65E1F27BD0AD3D362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18bd4bde-b1f4-448a-9b43-c739226d0776.tmp

Path C:\Users\Admin\AppData\Local\Temp\18bd4bde-b1f4-448a-9b43-c739226d0776.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2d41c4b9-8a60-4338-8946-05dbf6eb97e3.tmp

Path C:\Users\Admin\AppData\Local\Temp\2d41c4b9-8a60-4338-8946-05dbf6eb97e3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismHost.exe

Path C:\Users\Admin\AppData\Local\Temp\FC79A053-46AF-4EF7-8E60-F62A725D1A1A\DismHost.exe
Size 168KB
SHA256 dead0ebd5b5bf5d4b0e68ba975e9a70f98820e85d056b0a6b3775fc4df4da0f6
MD5 17275206102d1cf6f17346fd73300030
SHA1 bbec93f6fb2ae56c705efd6e58d6b3cc68bf1166
SHA512 ce14a4f95328bb9ce437c5d79084e9d647cb89b66cde86a540b200b1667edc76aa27a36061b6e2ceccecb70b9a011b4bd54040e2a480b8546888ba5cc84a01b3
SSDEEP 3072:u6bLa/eoNP/VYbxYxVipvxx9hXD0L6/Dk6F62G0rrqw:u6q/eMYbxYxAVxr1DY6v62G0l
TLSH
T173F34A1E76A934AAD566A13985958145F3B3BC31171213DF12E0E67E2F33AD8BE38F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cjs0dxjn.hue

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.PackageManagement\cjs0dxjn.hue
Size 810B
SHA256 3a5b53e1432339fffade772213ee60c728d385d3b0a51e2968a92ab8e62fbb71
MD5 8c5ef7b27de9645a016afff410cc1445
SHA1 787f07e30b37039bb2427d864cf8b2ad5b2797d8
SHA512 2b60860ac6c5659cfaeb4cf2e9287a0bd7770d5861240ae82bde5011db16c583e8e6bdd3955eed463c159b3274315d765f5dbf46a9caa3fde16e132466df77bf
TLSH
T11F01F191F017DA3602B25F75BE89EC4CF36E72C308A8228D3C934837F2274876553288
MD5 SHA1 SHA512 TLSH

Submit Download

togcidia.b5t

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.PackageManagement\togcidia.b5t
Size 1KB
SHA256 5990b841a5f3756f945adaa9d2e590759757b05794e54962ef50edb62a5049d5
MD5 58929bee31064a00a6bf785ae594b0bd
SHA1 7b0e8c8a1550e17b8084df95bdfbbde31262b355
SHA512 f1efc29e26e4bc7b376b57202e9f1d1b166fcd1fbc2369720d99223b3a8c7a66115d42c7357e9c63708a35ae9d872b1ef7689ed0918d1bdd5ac39702dbe0aa1b
TLSH
T12A3182D2AC16946D07311CA4FA49E90CF33B54ABC98471AE3DD60432F76B096F83718A
MD5 SHA1 SHA512 TLSH

Submit Download

zpacx5hj.wdt

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.PackageManagement\zpacx5hj.wdt
Size 170KB
SHA256 de2ebfe08d13ab88efc596dcc2aa39982ebc61366a6a222789fadf8f902efc4a
MD5 628da2d060916bba4e8623eb3e53cdc8
SHA1 2f7bf1d2a9bf85ec1a7bb7eaa5f24e3c281d96d5
SHA512 2d4db1b3cc0a91f000ed6e8e8231b3824297cb5f34ee551b8208561e079031f9a63bf37da62f105f324ba4ee2530cc152aed4e01ee1aabfa66d7be09220d838b
SSDEEP 3072:CNAQHZ+Scp5yD3NG99urukd6D3Gy6gdkZkFpT7BKaEm:S53Ui+Gyb6GV
TLSH
T1CD045B76A3F8565AD6FF4FB8F47450804FF8FA076800DB8E5C25A0DD1A237829632667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_df5gia1p.35a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_df5gia1p.35a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BitsUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\BitsUtils.dll
Size 15KB
SHA256 ab77c0a6c79e76ab0f509d655273b2ee5c682c702217f4f884bbab3d2fdfc4c0
MD5 8dd17c172a24ebf9601308b949a9ea22
SHA1 507e586c9f69ddc7e58442631efc44f3fe58089c
SHA512 7de5a35771ac8ead2e3096de29bdedd8e94696d35dc304388c1cff2a14bb264e389a576dae21aaf9cbac79de6c99606b61f1dc5f0ba35fd261b2f5553d389e59
SSDEEP 192:3VaJs7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRPmq514Lvsoj:3VaJWvDGFtart8E9VFK4iFm810Hj
TLSH
T1B3623CB787905C66ED7B8D7530E4C9267A3577475BA084F3126EC1009BC07C27AFD19A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ioSpecial.ini
Size 1KB
SHA256 ce856e0668317114b36333af8033e7323a9df50c1bc414b2a4cf357266dac044
MD5 ab1b395cb8c5704167981876d1b24909
SHA1 384e40c5dac45a0094ac07d7612794344535e2b2
SHA512 94336e48d5feed875124be74b6d01f604359628a55296a53d79d8da2ad287ba78bbd660f86f53c903247eb6fa38bd7cd97c91ee66a1606accca166014ab58b3a
TLSH
T147316B572BF94114F6BBF718FBF0953997397840682EC51E91C10A0E49FAA808527BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ioSpecial.ini
Size 1KB
SHA256 c87800f6116183cb5e5de87448d6e1d412f7ebe7a9c0d2d75039d3439f26e0db
MD5 5490b44f0cdcf71bf2fc546242f80b9a
SHA1 819552b06fbe07f9a2aa01bbbe6519997cc3346e
SHA512 b4819ab579d52cd637befeabd35d46083ffa8c1a78b42860be1ede43ef012177c9866871fbe56665bdcc0b4d95f14d3c92a153725d0e2486c48af628a7cf044f
TLSH
T18D317C572FFA0514F2BBF718EBF0953997393841682ED50E91C10A0E49F6A808567BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ioSpecial.ini
Size 1KB
SHA256 631be1255e8e16fdd29a6a1af61000d23daa954fa8bd6eca3b806f037ac3a5e3
MD5 d7f070299a23172cc89419e943ee4fcf
SHA1 9ec7c2fb3ba07ec1b2996dc02f028aa452469cb6
SHA512 3a581fe5ad99c519846efe236e86039bdac2e5d41c71e664cd8d5e5ce8cd192960f3f03ab3c6b7b081b3c47d2d7dcac3922543041ecbc30f3cc4e1c0ee90d197
TLSH
T15B219D132EFD4114E2FBBA08FFF09575973A3815582DD50E81C00A0F49F6A808923BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ioSpecial.ini
Size 1KB
SHA256 9e93cb42e2d82600e55db698e667eb5d2c1f1487cb26815815cc39c151ce9afe
MD5 c7a45690b75ad8c0f4938af75ae63ce0
SHA1 bddff1d0c419b7914b3acc651788b648d87ac7b9
SHA512 9b1a6d16d075ee8288d882e9eeb82d57438e86e431ba483bf170f710e71fe13847b22eff2d695f4a0218e33f63c7e05cc4f4d44f37c04b451e6c7e9f7a870edd
TLSH
T19D219D136EFD0018E2BBB618FFF09575573A3855582DD50E91D10A0F49F66808923BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\ioSpecial.ini
Size 1KB
SHA256 ef9e11eb803dee634512084d06dd18ecd874ecea3149c804d262061edb0e9567
MD5 783431a3765b7f49a6047434cc5a45dc
SHA1 ed914307926bd29ab7b326ab02ae82f9feae97e2
SHA512 91b890cc8c8a5c0bd1ae0fe51e09142f0c9d2f15e272de62a9c8e740b562580c7eb3bf3805ef8a63422002399c4c5000dd8259760c6c4604133acd9dac34b770
TLSH
T1DA218C136EFD0018E2BBBA18FFF09575573A3855582DD50E91D10A0F89F66808923BEB
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\modern-header.bmp
Size 25KB
SHA256 bc08eabb8b11b7693ac5de4db4d787ae31fdc9f29f6020536c838793bb2d4438
MD5 d74f354a7dff27324b463404f4eec99b
SHA1 c0cd9ec50ef163bb868f574db8ca97ccbaa109e4
SHA512 09116cfc89e16c0cb104e13292976fe8cb97131f309228fd6488a13d2afff4b902ed490f12cb633be232654ceadaee00f23cbe6206677e61c0a9642c72486c4e
SSDEEP 96:a2DxO/4FdJx5Cp7I3ciDzBtaM1WJ7hsST3dcujZecRo/qJOPn:a2XC5kFDLrC9sbEZecRo/qJOP
TLSH
T1BEC2C7809535FAE6CD508C50ED59403B035D2CB9EE989D4BBEEDFB5E36F30B8402A154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\modern-wizard.bmp
Size 150KB
SHA256 76da716588b8e51e36ee7a674cd873a8069e27fef73851d1e190face5a67fc66
MD5 49ff8ad8f51875597f3e919e8770c24c
SHA1 1e840ce0f68281e312317bcbdbc10fdfcd3959c3
SHA512 dcf29bbef46b1bd8d9f6c6221955ab06da23bc6661c603c188ce34fed80984a3b6d2006ab38b49aa9d1908d714cc0f40e63b6230244e4d4a0c9baebbbda1ddb1
SSDEEP 1536:KnltLBhSpBSMNmYkeEzAppt87b50m8lEamLwPbP81d4u9DOMkQTkWFdfCoUxZpg:mltLBWmreEcZOb50mKEaUwTM
TLSH
T177E396C549548EA91CAAEC8079BBA55B9F0C1EF8E270DAF1E7FFFD078551EB24016210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unconfirm.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\unconfirm.ini
Size 534B
SHA256 9583d5102ea8a0aebc498a8ec4097acd4f3ffb9b6c2b6fb0174299e193f28e5a
MD5 e60836b60f626e72dbaddfc15ceb636a
SHA1 c092f349506212861ab2fe8779190cadcb81b2bd
SHA512 aeadb800aa16a4286c14cb90f43cf3b4974cd1f93d688b07c2f0acde9f23316061b9b4aee672e4c334f70737a4ea3ccea98a161ea2aa3d4e354fa4818d8d30e2
TLSH
T15AF0A0136EFD0028F4B7B618FFB140B993343806482EC80EE1D14A0E48F62404567BEF
MD5 SHA1 SHA512 TLSH

Submit Download

unconfirm.ini

Path C:\Users\Admin\AppData\Local\Temp\nsw19A1.tmp\unconfirm.ini
Size 620B
SHA256 6ff31b70cecb02ebd8e838431cff7b180987a39767736ffa3bc7138fddda76a6
MD5 f6879a00c3ae32acff326f5882c12aca
SHA1 d858f7ef5011f5a2f6591db4a18e74b1a3582b3b
SHA512 a2c1fe439565cd529ad5559cc7a4caa83b04dfad13a872f959974da3579515d96dfa00aa489dcbb470d85e560a0fe70245ce0251c73b706d8a81e7c2835178cc
TLSH
T155F09A132EFD0028F4F7B618FFB2447A93357816082EC41ED1C14A4E48F22108527BEB
MD5 SHA1 SHA512 TLSH

Submit Download

py3l2jau.nupkg

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau.nupkg
Size 19.9MB
SHA256 726602001e6137efff66aa73c197c6ab6396ae2f9634d0adaada17ec5068ee46
MD5 2868d89f573801a23b4952b6f02b6dee
SHA1 0d32e86fe20cd8b64d1358fca776c1666aab97e7
SHA512 de5818da64d4362904ffe35737a2d7dfc7179cb4d248e5816ce89afe7e08c0a8ac63012f5489095f49724e1bec0eaa2e53a90593aef204979de6cb27534a91a6
SSDEEP 393216:b/ernzdoYacPrnv15NA7ppNaKzsSfQnyHrnzdoY1cKrnv15NJppNaKzsSfQd:bwdo14v1rARaK1QnyndoOc0v1rfaK1Qd
TLSH
T1B227334BC4ABFD657DAD32FDF8005E1F33592DB4920901E446194F78BB589E80AB2CDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Format.ps1xml

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\Format.ps1xml
Size 30KB
SHA256 7a6bc5792948a7e4ed77eca54814609de278dcadc6b50ae247cdab0a0d59e8fd
MD5 4da88eac4d3bebb33479b3e53581767d
SHA1 c21f06237f0579bfb52d58a1a3898ce58585d5bb
SHA512 03f2b6d30f57b062fdd509ff172ad9d1e7ca5e05da8502902785b893b6897e2bea84928a77153bbea5e028e52745d2db37535e1abe3135a9e30dd83f1dcd2ebf
SSDEEP 768:ttI0rQ4/BTzD9DmWNFfTog8GTh8LGko7wrw34hErd:vx9DmqFfc7dr7eJ
TLSH
T123D2202F8BF035F94226C965AAA9162D0F286823784F7AF475CCA70F1F58D4A4573C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinGet.Client.Cmdlets.dll-Help.xml

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\Microsoft.WinGet.Client.Cmdlets.dll-Help.xml
Size 346KB
SHA256 dd9662069bdeb625a51b419765276e35d2e471150cc02cd9cdbfe775469c01e9
MD5 7e441b1d7230c1a2927f43081e3b0565
SHA1 b390106d82b2ef29b9cce11d3d69157233015b90
SHA512 abc8db7393c049a88bc4be94e81ce0fde3a84b08321e4d7767673b6fb174dea8698eb1b66368d01a4e9c538a3aa502281323a8c3738f30a1c2d16b45c93a61b3
SSDEEP 6144:wqC2SPeQBrmcGoGbWoKL0v0Ld7Kv0DxH4RHElSSdqNrVAaNmd48Q61WwtYfVOj5Z:wqC2SPeQBrmcGoGbWoKL0v0Ld7Kv0DxR
TLSH
T1D474CE0CB7F892801075E90525ED90A4DE2A5387B62581BAF1ECFF137FB1CE5966B348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinGet.Client.nuspec

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\Microsoft.WinGet.Client.nuspec
Size 768B
SHA256 3746813d4fbe44b7c90b891a3c85de6af2eee312574891e217fac0b9bbb57fa2
MD5 8d3784767ef2e853ed4ceefcd816697a
SHA1 75de5def7e7663775b412470ffb3ad766da048bc
SHA512 737754f3f0fcdbb21bab83c3bc06accb855a0511d88c89e8f55945ee9c32b3bec72a4f48af33f5a552a5c089081518693f28d67637f86b27f331aa9dacbd8232
TLSH
T12C01BD80DACC9567AB79A957AC44C205FE3EA3F744CA8B50FC48A15A8F231CB9B93045
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.WinGet.Client.psd1

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\Microsoft.WinGet.Client.psd1
Size 19KB
SHA256 c91ae7cd8ca44108abbbff56759a8b6538d9ce2d8d3e4553ef335a87548d3fe5
MD5 11e7f25053bd6d065db749a109b86d11
SHA1 5a22dadd1c3c261a98ededf83dbd268d5f2ca09a
SHA512 2436756d3af7c5493d2287b46524291f5b1c06a77e1344f44b6ffc8fb53b9e641a1c4cf025104fcaeb8d7d32e02574491cf1052af2991d2dd8264365cf0de6ba
SSDEEP 384:3V9pDhzvIl8d8rsMhDZ1z43n8mHlY/48VgBuIacZUos3aGy3BIe+cp9RS3o0pYi:3v7Il8dXMhDZC3nnu/4AgBuIawUooW3u
TLSH
T121924BB30B63310B453F894AE81DC12EDB59953357E31358B44CA0248BB1F2297EA8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.txt

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\NOTICE.txt
Size 501KB
SHA256 df2727a5905a6b80b79643f711969fc67643cd683a4280624786f3710663dba2
MD5 6f92b8ca471667428cc7d79a4813c197
SHA1 171e22029b99f6b9127cfa0f49175e68dc57f7ae
SHA512 e34a4e5c78c4e47d22f1e30f88901545696de9f1866032e2659075319efc35a9693cd2fdf37cdb77c0753f7a8e3339ccb3a643f6bf4ee679d3d32029f413c8e4
SSDEEP 3072:zGt1xNbFy9RsnGQ0t1DLd0bbVboebeCtdPTTWs:zGxehLdG3V
TLSH
T1F7B41DDD6E2E47352A56C2D3D4A7DD83F92A32462BD7AD83785CF35C2216C14B6EE008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinGet.Client.Engine.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\DirectDependencies\Microsoft.WinGet.Client.Engine.dll
Size 171KB
SHA256 da4b05c7679877909133484528d1b65b9734e54d6c798cf938f61e8749e41cb3
MD5 e3d46d38b9d2f168ba9f1991e2cb5631
SHA1 b084fb77e6f7998b2632b648876c0cf2fa06ec01
SHA512 9279402c3d8d33164371515a25f12b7de1255b4d0e3c5290f283e31b38dd86d13525e551ce8e9e9cc84a7e9bf362e42739dfecfd0ce3b8e3f149b24bf471a866
SSDEEP 3072:4+5t+XrRPC7hTkUQRNiDIou4Bklw+7mMKk+EiMwBTdyTq7F8D:4ut+XdGDlu4B2CkZ6RyTqc
TLSH
T100044A5867F88B26F97F1F79E67881118779F203E90AEB4D1988B1DD2423382C9117B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinGet.Client.Cmdlets.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\Microsoft.WinGet.Client.Cmdlets.dll
Size 37KB
SHA256 b814105ee7c8b56c4a1f6bcd34b7025ae0e106aed472f3d9ceb4838c5bddc5d7
MD5 f8638948dca5a50dd9d19b27f20c6ed5
SHA1 17ed629080d30695233de5154a844f39fd655baa
SHA512 cc743c99d28b15dadcee4038097d9866e1e38cb58b3bfe3bafd60cc2a6ac96e878bab7b67df7bb21267440f408748a5c28f90d67233dfc99bf5a53573a0f05c4
SSDEEP 768:lB9JvgMJwZdG8H2X0xYS6/QXGUMrr9zONH1:lB9JvbJG4K2kC8XP8Bza
TLSH
T15C034C11839CA36BDB8E0E35E42096291739E386FA61EFAACB50F50D2D137C99F14536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\Microsoft.Win32.Registry.dll
Size 25KB
SHA256 e9a9d281c1a708aaae366f82fd6a1742f65da2918cc4fa5eaaaada0be24277d9
MD5 59c48aacb1c413c108161afe13fdbed9
SHA1 31ace4b26d8a069c84aad6001e06c2a5483806f3
SHA512 8252abe64c67863d9e4c70e820f0c69c517b8678a4b4c13a436118bc276e5f21e84522b93566c0bc009effcb251ed67bdbc60e4907abea2f33b6be3764e28d1d
SSDEEP 384:j4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWfdHRN76+fVlGsa9h:j4QVrxViR9mlxd96lv
TLSH
T140C22912AFE8023FFFFB0E316975D5120EB6FAC52912961E1548D28A1DB2BC8D531738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinGet.SharedLib.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\Microsoft.WinGet.SharedLib.dll
Size 26KB
SHA256 8b7157959209c34b0bb1d73f0d968a293341a46a36fa17cdecc12797e7036ffd
MD5 b6719cd2c5a6844ca748c48be772545f
SHA1 bbe7bcc101d3253777b98f131444e121be4f1ac5
SHA512 2422c117e6e2b468a81a4da5eb98e0bab5898ebfea5e6ec662e7f3c861d5372eecca72667ac343bfc954a4865840b6119495104dbb100cf9294e51a79cf878f5
SSDEEP 384:jb8oI8yV/v7PXWPcjV6lvg4tQxK4G0MuXAP6GWtcR9WI9gclNqR9z4CoXnlh:38ov5koYMQlGO66gZ9k9zUXnH
TLSH
T1D0C2FA8293F86609FDFB0B70AEB685523D387F826902DA5D1061618E09737D5CB25B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\Newtonsoft.Json.dll
Size 705KB
SHA256 791d8eca86c688ef5c0da8a1aaf0178308cf5b47667760a5b0e5e1636e201878
MD5 7db8d72deafe4f919c20cd5ce5439a83
SHA1 68315a1b050b5c40181c0d680c23464e93464de4
SHA512 ae4fdf308ce79e74ea80d7da4421af078b38bc9b9c504289cfd852683940e05b18f4d37183ac3229571f654f83eb5f54f885e13a7e4129d8f9c7466565ff6175
SSDEEP 12288:vBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTU0:vBjk38WuBcAbwoA/BkjSHXP36RMG5
TLSH
T1FCE4394123F88F2BE1AF6B75B4704E1547F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Octokit.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\Octokit.dll
Size 1.1MB
SHA256 de54446297c36f68375aa84b94d90d8bacb70f5ec7faf02bf1179043f02b8c0e
MD5 3e3d64f44c7a59b98106032aeb5fab3d
SHA1 f519e52bad8101ad9a4777a7e1f26dab43f8460f
SHA512 3ff9bdbc50744b9cc697b5af9f2bdae938ae1ef3b8bc8cb76882d9292b06d037d09cac221b935e4ccbd758024848274f005fd5ccb1d0b45cd6cc643f5a0a3087
SSDEEP 24576:NLWjL5NFInYtzuDuGlh2a5a5GKfB9eMQS1ZD1/R86eBsCTFHVzbi/:2L5NP9hGKfB9eMQS1ZD1/R86eBsCTFH6
TLSH
T195452AC82FE88A36D69F37749460122A0672D1ED7BAAE75B273098172C43F43BD51277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Semver.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\Semver.dll
Size 84KB
SHA256 9977f7fdc2aa9f035f10c16d31ccc0a170a2e5f3ef088a67bc92657a417008e1
MD5 233d2f12aeb191bd7c56327c4c0c92a5
SHA1 fd2b4c8b437738bfee1efe25496adc38a9e7a2dd
SHA512 da9227caa877ef032302d9af0befa0577c22fbeefee0af1d1866fa73996bb4bf7ac4ee3dfc9ca788ad980f192dcb5bf01e61e27b9ffc95c7c7bcc3a4c8a3d92b
SSDEEP 1536:Hhg/YG4YbnYROY91YbLzh2jxWsRIAVb2RU/d1Yz9u8dqXfMOx4gePK+0yNyAuGak:u/YG4YbnYROY91YbnhIxWsRJb2RmdGzh
TLSH
T1B5833A6A67EC8716F3FF2B3464B062110BB0FE92BE31E34E9E4491A919237D48951773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Management.Deployment.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\arm64\Microsoft.Management.Deployment.dll
Size 47KB
SHA256 9992d2897eaa29003179a14fa4d2879c7a919b3d9979f320e70592ac395587f7
MD5 a83febf6ad0cfb8f5e0d57a1fdb8ab9e
SHA1 b44113525bd45f68746468aa5cb6adf9bfceeed9
SHA512 ae7f0d09e1fca4a7c4825bcf8207f96383b48d72a62d67bb79ce39b7d377da871c953ebbfe574847ff0ad4d3538272c56b5f0f73e68d83c244d83aaa266b1842
SSDEEP 768:FBeX1xq5uTAQKcVHN3wKl94Si8DxBStMv194A09z/:FSxscVHN5QZ8TStMv8Acz/
TLSH
T100235A81A39C1883E6D6E27CDC628E45353FF7A9C420C1867252425EEE5BBC0E7B15D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Management.Deployment.winmd

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\arm64\Microsoft.Management.Deployment.winmd
Size 62KB
SHA256 49f2d63f9beb81f59e7aa0065b6b1c5bf838d14924efdf98d9bbe218f1762d97
MD5 1504749fc30fdf755b593cba08155025
SHA1 f247a0411669c111f43baac59a1788c44448bc58
SHA512 af5abf999fcf2ba9b2bfd4d145a3eb7dfd3e9bd77804b5ac0c042490b238bc2b27758c12649865ba406e8928a1a1bb106e02d4d00f2d7343b12030a1cc8cec41
SSDEEP 768:IJ0A636LVo7h04YKau2dfVCPdQdSWUfnO1dQhNWS7Cj5+HThjz9rvF/9zu:IJGKkALlVcisfnOvQrWLj5Gz9rrzu
TLSH
T1BA53D59358D48E31DC4B2AFE3A2A0674273CB75BA22797562CC4F9286C533707607E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsPackageManager.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\arm64\WindowsPackageManager.dll
Size 8.2MB
SHA256 f6a4dfac34322e96169f728bb8deaafba3e4d2a6a44ed672d58ff28a3aa4447a
MD5 9c69cfa7ce737fc13c294f1df1266822
SHA1 3b3c9cb4dccb91c97f458699908d3404119bab54
SHA512 18cf3575e41606b2ecd7d093c126578fe1d9d01e95779c5ee64a6e1ec80e6798860abc0565d96655d4dc5cfe2ab7e47423b498275503eaecd66beb78dedb4a13
SSDEEP 98304:j/lQlsClB75LgrqKblfK0Xb7n/26jrckbl:j/lWsClBOr/lfK0Xnn/26jwkB
TLSH
T1C9867D50DF4DAC15E2EAD37CAEA74B52B63BF6294220418B747D024CDFB67D080A3676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrtact.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\arm64\winrtact.dll
Size 136KB
SHA256 a51f00223de1f8bb1abdc635529204a73a00782c577a57bded10de1c32cc409a
MD5 d57710a0db58b10125cc4bd61c1b3bb4
SHA1 73beb208104520d7ea23654592b6f8fa052f4b78
SHA512 24562ec4ffc6aff7226c10f82a1262cb0d79f378310f693c13b61d57caf308176cfde220648f1d6638e6f7b5c011c2bbf86a26b5206253341765243355d809bb
SSDEEP 3072:RIDCkSG3FXYrZ3IjVxWmAHyJnG4PSkFlMkLDIoq/S0tLPI:2TSG1uZIjCy5G4eHU
TLSH
T1EAD33BA6778C6852E2C2E2BCDD92DF54332BF9249A3087477126421EEC9B7C4DDA1173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Management.Deployment.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\x64\Microsoft.Management.Deployment.dll
Size 52KB
SHA256 5fb2cd842ebf51c1c7eff5f9ded61d0da86f1d64fe938f6c02e1d9aafb597fa0
MD5 26460f5543c103974f53909925e601da
SHA1 ed952f52772833575c16981ba9db42d8af1c76f4
SHA512 e282536f2341868c700550f9b0895f342e4d38b945bd76aa0890434b5829cb5d540ff3f4288ec11bbfffcbae318e173acc9a0d984eb68cf81cab3b32189c6cb2
SSDEEP 768:L9eo6RFZRCuiwslGNXC6NJQV3vwVSUV+zem3i+Ovx9mCf9zAv:LfCJifw/qwVHuzROvmozAv
TLSH
T1FF337C81A37840E5D07B4175C4D35E46FA34F5B6AB1166DF23E8C2AD2E93BC0A23E358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Management.Deployment.winmd

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\x64\Microsoft.Management.Deployment.winmd
Size 62KB
SHA256 31bfb20b8ea331494de5747efd6c9377d017ce13c0d4d1ae8cc77c915c2245a9
MD5 cdd4b62094df92687b608221f480e5f7
SHA1 5cad224fd2bd9497470498dc5e8a3011d26341bb
SHA512 042c542be55f228ffb1131a42c3f1f6fd884b02ec439916643442494ec56ec4ebf4bdd9ce22e5f3f7fae3a8d8ca5ecad0686c6bbfe2ecb464e37e16e618e6e07
SSDEEP 768:LJ0A636LVo7h04YKau2dfVCPdQdSWUfnO1dQhNWS7Cj5+HThJz9rvpUs9zGpyU:LJGKkALlVcisfnOvQrWLj5Ez9rB3zGp1
TLSH
T14553D59358D48E31DC4B2AFE3A2A0674273CF71BA227975628C4F9286C537747607E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsPackageManager.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\x64\WindowsPackageManager.dll
Size 7.2MB
SHA256 74434365d1e639069d709a4f55aeabeb1174a775bcc66162d010a615608e0d6a
MD5 08cf6ce51d672a3fcdc6cb625029ca94
SHA1 c2a0b89188c6197a78fcf3b90bb2fd4e2d9bcbb2
SHA512 7922776ff33c865a9039d9b1ad5b10c0a2bc741c88f1df7ea357da0da2562a0001515d5f562f484962fb978951f0f7b20b619849cce0d04fdf1ee447ecaea2f8
SSDEEP 98304:Yf7OhN1M4psOXzTd3o0KDhbeIGiUfRuhFIQv:Yf781M4aOXF3o0KDhbeIGiUfRqFdv
TLSH
T132766C1A95A802AAC0F6D178CEAB4513FA71345B03359AEF35FD449D1F27BE1863BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Management.Deployment.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\x86\Microsoft.Management.Deployment.dll
Size 39KB
SHA256 552db70a60534cc7f4e2d0b64d30705417d1650475b48c5fb8cb335228c0b965
MD5 58e019f901d9f3064e2ed6f1f77f7874
SHA1 1af0cf06ff5829106ebe436e8c28951fff8e2cb9
SHA512 7ae2e240072e12cb5e8d08baf504977361f38a8baa454c2223e56d80fcbf6e1ff5c068ff104c32cabf284b251de293eeee1b03295f7548bd0459ed6101b2a1d9
SSDEEP 768:Xr8HrsSkg7J28873gH0lJ71vaTr99rr9zO7X:HSkL7pP1vWlBzi
TLSH
T1A9036B51FAE48863DAAE04706575EE53A93C7BB10FE099D377A9958C2E323C0E330166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Management.Deployment.winmd

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\x86\Microsoft.Management.Deployment.winmd
Size 62KB
SHA256 285ad0b9d54c4d1444175a567daa5bb98223a01654d9644a2b3561e763853577
MD5 80da1558a8efac351600a8d1e8a13801
SHA1 3b1f1771febc1e0b73d7c0b443df7b9520ba819b
SHA512 d5b20b74b027612fb6ca00c978208af98dc04019a83d2a67d918871880db6a3391112e08fa59f3a40ec3282c0b3454882af2edcbefe4d2c1b43217ac4cfa2eaa
SSDEEP 768:EJ0A636LVo7h04YKau2dfVCPdQdSWUfnO1dQhNWS7Cj5+HThOz9rvtAU+9zVG51:EJGKkALlVcisfnOvQrWLj5rz9rT6zG
TLSH
T1B153C69358D48E31DC4B2AFE3A2A0674273CB71BA22797562DC4F9286C533747607E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsPackageManager.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\x86\WindowsPackageManager.dll
Size 6.6MB
SHA256 b3e1c6a3a1f8748cd7a72910bfbd22e980674fecd358a2fe0fb43a17cfdc75bf
MD5 ce8c1bd9fa2ebf51f71eafe7b60582f3
SHA1 118b3bd0ed57f652b6bcfaa1645b3cc1714d4876
SHA512 ea5c3a674b639fcd80f35c9f7d7aeb7e385e55699a593f9c31e00a23e1c50bc5eb6078e70b4ede383c0b91a9b793fb69d7ad50ca112d3629ced5de5fd80085e4
SSDEEP 196608:JwtTgo7ziL0Z+6kPTD33mTazv+cjxhOlFlWweLeKHp2n0:JwJXziO+PPTTv+cjxhOlFa
TLSH
T17F665A21EA04C927E1AE02F1686D87ABD128A73B172600C7B2FC6D6D5F755C35632F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrtact.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net48\SharedDependencies\x86\winrtact.dll
Size 117KB
SHA256 3cdf314413855f842f1732a5964f08059deaa07992a1f088e7ca82734b0e9496
MD5 d75fc94ddd19875c91cc88e5e47a2f59
SHA1 0d039097c2725beaae05ea0d29d328a8af59970f
SHA512 750ffc10f96165218b51c3a22c3422cd1fc5487eadfefb638936b459f62147559a55869173d2d2cf8b98a393c4996901360fff40eb5250ba7a730bef0dfd77b2
SSDEEP 3072:LJK3OhBazdG58IHcWGpdRABwQoC7ghPMlh:Lg+m05UepOPeh
TLSH
T1D5C37E36F54AC1B1E5AD14BC89389B9BA33F6178CFA52AC3736466494C293C29F3501B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinGet.Client.Engine.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net8.0-windows10.0.26100.0\DirectDependencies\Microsoft.WinGet.Client.Engine.dll
Size 2.7MB
SHA256 77894b9f3f782805749312cb7c3b00196f2663014e844e7c01aed59df9d8a685
MD5 508182236a3d1b44e8cfdca60023a326
SHA1 9165516c0f0b735810a6cfdd4ad96a53d15308c1
SHA512 af49baf2ddf90bd346a25dd24cddcb6e62a6dd629b1f14d8f6fe237ca7209a34b5750da6b9507c66ee01d3376ad3aae14745d3e2666aea68be9a863736f692a5
SSDEEP 24576:FpZ2PvuRwaYSwXbqgbMH4MCAqPOU97wp3jpkYdF8kyC2N9ll:NWvuRFObqm3GzpkmWb
TLSH
T19BD55D40B3DF6F65DCAF2B7EB015821867B6E93D5703D7472904A2B12D233480F996EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinGet.Client.Cmdlets.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net8.0-windows10.0.26100.0\Microsoft.WinGet.Client.Cmdlets.dll
Size 38KB
SHA256 fcd521a571f9c8ad885b621ddf398ad63d74ed8a0e02b5ae3e4be2a898131d10
MD5 d1464c45da65afa05ebbdb282bc2eda2
SHA1 4a582b5b1ba2b6c25c8bf79e58b30a75570edc01
SHA512 bf76033ae23f320381f1ac3d71af0cfb6ef7d4feccc8b3c4fc1d7217cfcb570c11a6cf6b9ab8cfaa04968b356207de2d722c3a11f2ad4e8891b7bee4ae12d12f
SSDEEP 384:OeDGlFhHhuIW5uyheU9IXMYaDejGAVJrYwH3eSBV9wDEhRi/y/j5OTRcFDuBGmjZ:OeDxuvBXEZA/YwHOyrOEG/3G9Ci9z7e
TLSH
T1D6035D124B9CD26BDD4E5E74F4B095601738A38E36D1EFA6C690F40A2E13BC96F25633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net8.0-windows10.0.26100.0\SharedDependencies\Newtonsoft.Json.dll
Size 705KB
SHA256 838964aa01fee538c26de78bd52deab6ac3c30406c5933cf452ef29845203d4f
MD5 01247033fa95b59deca63204c298ebae
SHA1 30b2ebe7f922f9a28b7c458687709b2b5ddff04a
SHA512 2fffa85d4639b700913f9d165485b55e0b5d6bc11f2313cc770f3e0ec3b680335aadf82cd03218bef49bba0450344f84577902036caf69187d8da65ac5ac4345
SSDEEP 12288:WFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMj:qzMTMNNd+g5Wk78GBBjgrIQtDE
TLSH
T14DE46A2123E99B2BE0AF2775B032491647FAF542F6B3D78F5604D8AA1C43F558D82363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Semver.dll

Path C:\Users\Admin\AppData\Local\Temp\py3l2jau\net8.0-windows10.0.26100.0\SharedDependencies\Semver.dll
Size 84KB
SHA256 d4601e5f6cebbb658673ed0d969f978739a53c5dd1a0eda18d092cebd18f2011
MD5 c92eb3cdf55680780e6a9f5dd42cd80f
SHA1 dab0d11ff98297029b67c0c65189784962cc6d06
SHA512 e9d971e1b81085438fbfd83a91d4ca0e57a1c621d6f9bed021b16c39173a86d3ba5ff5fe607197aa31d816cd3c5ae7fadca0216c96fe53adf009de5d77234d76
SSDEEP 1536:LhS2YGvYbnYRLY91YbIhtOAWmVD33xL94AQORj64TnhrMbzQ/nyKe6yzyAqzaJz/:A2YGvYbnYRLY91YbIhUAWmVjxL9ZQOR6
TLSH
T1C4833A6967ECAB56F2FF2B3464B462050BB0FE86BE31E34E8D4491E91823BC44951773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33397000-c24f-4f92-982b-41f497765178.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3644_1151750845\33397000-c24f-4f92-982b-41f497765178.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3644_1317936642\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp10D9.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp10D9.tmp
Size 23.2MB
SHA256 fa994badb1e90b2629e0d955572ca57efe97169d20d6b4957e2f830e3680da9e
MD5 9e936c2078b286132cd6b9c8602fd17a
SHA1 f638b8a7448daa6da754c9bb2fbf2cf4ee1b007e
SHA512 6973f1eef2a2baccf2b0bccf5047f6db434698cd483c0b0dfbfcc2230c45bc1ce4a23e67b5ab7ec8767d4cc8d75dcc76eeb347038eabdf5ec99bc12e3a3bb946
SSDEEP 393216:K6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vY:K1c877xqpyovvVWJ6VFK+q3cSvY
TLSH
T1FF373382A12D8EC7DE27E639E3F3E96EC788906A539590415C26F8917641FC18FDBF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un_A.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Size 759KB
SHA256 90123cd4ce9ee35720308a1c5759db623b6da08477e06686e8000057c196e5dd
MD5 f3a9b4f3e6631876ec39671dde6d78de
SHA1 f7d078ba42b201348acbc6b720ab42a4c8676f96
SHA512 8420f786d7e71579e9c5bdb8a130017329a88adf822913e2af449beb452b8e2245373dcf62abfa2ec3b232e4295db0c299f9ca435cd5f6e41bc20ea0ceaf8e5d
SSDEEP 6144:jT4Dt7UjD5x1f95+W5m7sFo3SobcEP+dLWKtsm4NTz:jTyUjD5xt95+B7a2SooEP2WKtsm45z
TLSH
T10DF48D41A790CC62D8AA8C3078F5D7171B38BDA5AF60C6B3736BF34D4E717A1956830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 f152a730532f1565752f473da9af70359b0975c8324f9b108ee2a610020c8eb8
MD5 41610f7d9bd4dba94a070e589c1aa794
SHA1 2e986cf2be780236711d41de6dd0c2a55c4432cb
SHA512 735a805bacaaa16fd7033474d5796c0d12a1a4f097d02fc914b87b876cd1df75891a9b1f2f67603ca95828603ab133729e8d2628718efeae2a095bac05a75874
SSDEEP 48:AuWzUq3GdEX3CP/HUSueraZBJFnukvjwoOsqtJMCKFdGZrJhSogZoufKtJMCKFdi:A7mACPMSyBFukvMrfXtfQHAfXtfQHO
TLSH
T18BB1DD1017F60A29E0FA8F756872A320A7B5F842DF16DBCF1340B1599C70125EA3C76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\iz8l3zbr.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 6891974454ebb94930687ff83611d778b5337d4bd34764c12d83f74cf1e2d9d6
MD5 527fbbb621d34b53206d90d410249585
SHA1 cadc4105e72b93f9b0b9a243e631442b83208484
SHA512 83a62c22ac7b19b56edbb83814361599a33657944ef2374b2f6b29cd88da3d463a1fb0ccc0b9ba18544f5becbe802f3a59b133cb77428761f0636ddd8878200d
TLSH
T1E121A084F728953AE449C33ECC5667218F30A055D48EBF25346D601C8E1A61A36EE83C
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 b40ccf871ec9700d37c214a46dcf349c14a47a4154236132e4dee6ca0c67b107
MD5 77844a8920443fd6c7639376debaf5d0
SHA1 6c6153e0a73d13b75ef533e20e1d9b9894044080
SHA512 23bb9ee3e84079288bcdd628ecbc5efa9434ebb690689f33b6f4aeca7e1e7a8a9020b73b1a05a8c9f1442ad562f67b8d1fb561048618ff1dee037ad58f065191
SSDEEP 384:YboP0aYKNCk2RFKVyG1LGcmhulaTRDtpvbEbrb1bGb1fjd66JozQzgC1jd:wwNGItRGcmhuaRDtpvbEbrb1bGbhMm/
TLSH
T121D2F144EB2A953FD42912BBDCA50B001F79F88A59092F673A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 7006e4cfaca6571e54389b3b5ebe7f5f9b2e30a274c43b77a255bd2f3556b1b8
MD5 2610efef2bb717b5e70f27a88d5be307
SHA1 5c59a844720473be70fa9e4ae2329ad805315f39
SHA512 9fa7d4d41e949e8031e212fda678d7ebe10507e5d3dcab4fdf06d0c5e98452cdd5f1618288fe4ae2e6b53ae072c5772fb44605d9fd14a09f5ef55284be56ae14
SSDEEP 384:wNCk2RFKVyG1LGcmhulaTRDtpvbEbrb1bGb1fZbooCyj3d66JozQzgC1jd:wNGItRGcmhuaRDtpvbEbrb1bGbh56fm/
TLSH
T1EFC20044EB1E953FD42912BADCA547002F79F88998192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 09e7441e5c9f19f06a20c991f7a52bff1d2e5529c2ce660fd2a2a04ed8036cb3
MD5 464f291d0d48a15666349c157b81ff53
SHA1 c1b64aff0b8cf240dcc32d035e9506f0319afbb0
SHA512 d80e3591b233f51f7e779facdb4e56005d37b3ec33c1a988f9312fe74f7c385eb378e67086795dfc9247ee6712cccf36aed47ab926e64bc9c89e848ed09d46e9
SSDEEP 384:od66JozQzgC1jsboob0ryjxNCk2RFKVyG1LGcmhulaTRDtpvbEbrb1bGb1f:Vmea4NGItRGcmhuaRDtpvbEbrb1bGbh
TLSH
T149D2F144EB2E953FD42912BBDCA547002F79F88A58092F673A5C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 ffabe30b3108121cc185a000f0830b2eb5db9a9ae34aef468fdd819c8aad990b
MD5 2e6c3099cd7f2b729f2bea2bdd5442ea
SHA1 07bd234bf3205d27be3bac40df760a1bb017fe68
SHA512 18099a17ab1bf813a4589f96d4a832df34d17b79bb0894ca56143fe676dcccb6384e31559bbf4a598a7a49ecf7faeb3909267d9daa75f2cf06ba9c47a3e6f4a8
SSDEEP 384:/bol90ryjxNCk2RFKVyG1LGcmhulaTRDtpvbEbrb1bGb1fld66JozQzgC1jd:jL4NGItRGcmhuaRDtpvbEbrb1bGbhSm/
TLSH
T117D2F244EB2E953FD42912BBDCA547001F79B88A58092F673A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 3afc5c7e9bcca19e952c8f2fffdc7cd7900736a2f2db664e06c1debc24b19818
MD5 51b5283aaa9161b648d669677c03a7bc
SHA1 1a048a3141a6b134b45f30377b69c419172a62b6
SHA512 56934fec679b9b153e79703fe836a86e25f1e73bbcff284c5ce89d5228057b117e7f4f00267766784d3c48bee3faa489d8fc7387c087b714001a90bbd59ce13f
SSDEEP 384:oboWZ0ryjnd66JozQzgC1jdNCk2RFKVyG1LGcmhulaTRDtpvbEbrb1bGb1f:gudm3NGItRGcmhuaRDtpvbEbrb1bGbh
TLSH
T194D2F144EB2E953FD42912BBDCA547002F79B88A58092F673A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2665077f9e112c22ffa4066777a363692ebf9af54970be1b0e637af8dd6ea8d6
MD5 89dbfab6f9e51af22abd98dd3fc7bcfb
SHA1 bbd05103ee0e5e51034d9303ffed8de929a64717
SHA512 5274d86f156a856341bd16bffdea03fa7cfa1640e2b072c35dc0ad50578f684ce5e89e4be554a8d0d88ce28caa21db61d5345b7a13eda76377cf453e3b741834
TLSH
T1EE21425C35F98D1B68C7F7ACB440098E63554F0B09871C831D52EE8DCED96D93269438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\events\events
Size 6KB
SHA256 978797992757998cb3ca9c30bb4ef2b7852562e790355fe9aeb39dd97dcee9bd
MD5 71a706ada239de152e1c78e7831820bd
SHA1 42b0f6287c47c2e1c14d3d5c5d1da8d89947527c
SHA512 0d5739fc92e91fb7a07777c9eb010585fda9126a9fb5b8d2914e905bce54503c9d36e78d915455f5c440b7bc7b0ff8dbc4216d856812360b4eb99eef0cf2bfb9
SSDEEP 96:SCLlzmRtoqMUop+E/V7Et40taqHE3vel4L2YP:SCpyRtLMfIE/V7EqyIvel4L2YP
TLSH
T1C6D1FC0932BE6CBE7CC383B9F844068D52C5474789DB1D870CE2DD5D8D1BAAA311F46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

131eeae7-1244-46af-8bf2-98294d74b42e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\131eeae7-1244-46af-8bf2-98294d74b42e
Size 235B
SHA256 f7d3b7f23465e3a2c7030f0f36d30db4b8007f2e810082307d5076df15e4d431
MD5 ea5a83a3e462ef3c71d0baa1537c240b
SHA1 bdaa9e37ded68df7874847df3a02a2430a2d891f
SHA512 7894c9589304392f3967c8af1efa7acc45dbf3861c88c8e3af01d8aa7771852525209fe105d6db882c6a88fb2fbb7fbee3c5abc4e3b6ec5c6601ef9ae9c7ef27
TLSH
T1BDD0979028D8B76E08100F0FF0E169C331448C3328746810EEA044B48ABCEC45121807
MD5 SHA1 SHA512 TLSH

Submit Download

1c7ea200-a7b9-4296-bbb9-dcced69db5ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\1c7ea200-a7b9-4296-bbb9-dcced69db5ba
Size 886B
SHA256 6a4680312835c784feb44800e654e19dbe1021f68bb8771a00fcd1e4394bb769
MD5 c6a0efcf5ac9cd69b860c37c2246476f
SHA1 0d84e1f356a18a584ef583fd2432c11544cb466d
SHA512 97892de6d3689c3da3b6ff41ffb4b851d2099b3fed49871661dbe309f30a58069258def1fabe372beb03f7b2485fb96a547bc0bc98ee33c262ddcee380ddbf61
TLSH
T1A21100448534B9F28C39929B95E577528BE87033C0C65C087EA00A080DEB11E6B7B70B
MD5 SHA1 SHA512 TLSH

Submit Download

4e096681-444c-4c2b-b1e0-0f4221e905ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\4e096681-444c-4c2b-b1e0-0f4221e905ae
Size 871B
SHA256 bb95106d1767db4bcd56821d3b9508568efed0d4062f937997c1fc529249983d
MD5 76b7284005e1103eb8ca98c0acdfc22c
SHA1 c94abc6f3c6338f2aa3284d5fb83513781bb3dc8
SHA512 63d4d986006f19a9c11f36f872e13f77b3412218eadc1278407fd186fcf93370fd0505e5b3275afc0663a055fcb99f796d104ff22ec69c6daf32797e4b46e3af
TLSH
T1F011EF458631B5F2CC79D24BCA9677528BF4B53380C688143DB14E080DAB62EA7BE60B
MD5 SHA1 SHA512 TLSH

Submit Download

50bf98ec-2296-4296-8787-57280499a68b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\50bf98ec-2296-4296-8787-57280499a68b
Size 778B
SHA256 b826452890e7476c409614b6100292a2c5c49765b09f2f078afbe42fcc56f190
MD5 69d2d3ddcf5295ceebc5cdcdb782c30d
SHA1 95f1ea26cc42cc4190885928babb6cd34a6fb887
SHA512 6b37a3f7994817818657055fa39af0faea0d3afe731b97d929c94f9863b065cf690e1329822b7d0f6c9c20e0fefd8126aef624ba48c4770c1ba60f0f9e3ebb46
TLSH
T11E0125E285327573ACB9D30DD569BB6B86E4A032C4C744146EF898080EFB12F813270B
MD5 SHA1 SHA512 TLSH

Submit Download

5ddf583f-67b6-4bbe-a053-1f7b419af412

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\5ddf583f-67b6-4bbe-a053-1f7b419af412
Size 235B
SHA256 d95d120e95bc70ae15f8bfcc6458233fbfff4cc95f0b17688b8c5b749122f087
MD5 9309493dc55fb6c2e8fec8925dffde4b
SHA1 755672b23901e1d5d241566b02481085d271c076
SHA512 312df7df6b1647adccb2b6755660a52623238904e90c6ae658a1cfa857722de57c27d063112f05977ccbd118a5a0b36c325be278012756efaf4cbfc8e3c5b61a
TLSH
T193D0978224DC372C48080F02F0E1B8CA30588C3320A458208A6004388AFDAC40263C2A
MD5 SHA1 SHA512 TLSH

Submit Download

b386ef6f-0d3f-4ace-a233-5c6f1948f2a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\b386ef6f-0d3f-4ace-a233-5c6f1948f2a8
Size 2KB
SHA256 f83974d9c6c564051bf680de36c41728ca80d8e02dde6accb10838deabbadf43
MD5 b9eca0b9addcbd12a6369aa085ca86c6
SHA1 a8e68adcbad0db1cf0fd7c4cc1dc25c942724f85
SHA512 dae3df37320ac6107857e1c8e84a5254de194265b78430d87fa252b1485c259eed90d9f5c4da17f059f89fdd63218aeb3f620c43e6ec83d4c3c9deacb8d9e266
TLSH
T1B241FE6C35749CB69CEBE59DD582228D93648A1300C268833E61EF0C8CDA69D337B53B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\extensions.json
Size 16KB
SHA256 40e0993d2bf5c5e913edaa237d69bb1dc61c7092e23f53d003b7166676b17c21
MD5 ec9bdb1521b210f23792ca4edcccecc9
SHA1 701e95795dc2915643276c8276ac6633b42fdfa1
SHA512 f280139cb3497034a2a12929c2b2d0d68c200f9602fcc0426ae79b17c9ba965b6b61c43c845aea6ca25054d6e845973d70947a7cc2f82a49f4ad67ffae137cd0
SSDEEP 384:jkI4vvUmldv7s8dhWg94zz96obL4HTL4PQL4HLL4HaL4H/64hx:gI4nRfztX94F6w4/4a434I4y4b
TLSH
T1AC72411545049EB8298FA79AAA367E01C37D473B70845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs-1.js
Size 12KB
SHA256 779f08e78a599f41458b615075f427a639fd2c887925143b827447aa6c3a29f7
MD5 c502ba8760c85ae24deb65d3770db780
SHA1 18283931a991e60526ee8837dfcdf96eaa035c1e
SHA512 8f50b84c074c81452a80e7553b4cb6878403ec7a6ebf9ee443c36a85868fea57b9d00c486dadd1e888b2ceaddff2e9d980d8855b3d523b1ed07d0e7155168bd5
SSDEEP 192:ZzR5u6Qq6mYSSp7+LRf9VigPBBw88kfI7GPLMS:luORVVi+w0QWV
TLSH
T15142AC38A1448A7F74F2357DBC244E7169A1433B7BBFBCD215B944A1045CF2881EA9EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs-1.js
Size 10KB
SHA256 1063158844e5929e7e34def8786b3093994660d27b0759f9cdad8efaa6607e26
MD5 e354878ef48abb199e145215758c62fc
SHA1 d01aa5260c194215fdc89f46966224caef99734b
SHA512 d97b5891602562be59e79e22ac2923baab4d305bd5e0a5f3e0d41dcd27bb0111d6dff28073f0300788f22f782db530b6209b6f2625c6a6aa8087848e9c54ae86
SSDEEP 96:xHTFTUfqGqXpfQq6ObzS5YSSlX7+dv9jTnLWRrNRBoeV5A6vOBw88/q0mDJsi8L8:ZzR5fQq67YSSp7XRf9VDvOBw88WDJsS
TLSH
T1ED22ED38A0048B7F74B2367D7C644D7169A2023BBBBFACD314B95491045CF3481EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs-1.js
Size 12KB
SHA256 d94c8932d220d8bf3098c60fe7ceef406af6701872e9deae42f9f856f680d497
MD5 f9e8f41a4aca6e35baa65c521194145d
SHA1 28574168a078b98f2985ca7fb8dcccd29dc1663d
SHA512 da5d06a87e59ed5b8845100fa169174b68b3a0740ecc1a895f1f553818bf21277a4b820a51fce49548d93ab5ba65f3ade7cbb49c8d59bbf301ae2cdf24c0aa1e
SSDEEP 192:ZzR5fQq6mYSSp7+LRf9V9PBBw88kfI7GPLMS:lSORVVRw0QWV
TLSH
T1D242AC38A0448A7F74F2357DBC244E7169A1433B7BBFBCD215B944A1046CF2881EA9E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs-1.js
Size 7KB
SHA256 c4dc4a2096b46a3cdec2da2abf7d045f80ca4d64a37dea2c14b2e43709795264
MD5 c423411457b4bb5c6d403f6470af2331
SHA1 5f0825087079ecd50282e0934ff904f1739ec804
SHA512 567af1c026fb23372493fd9944c18a561dbcbfa59d241eb46f29fab04f9ea8cad3a6320ef14c61bbb4b0912f652137a639dfce3b3891338cb50f736c5cf21680
SSDEEP 96:xHTUTUfqGqgfVq6ObzS5YSSl/dv9jTnLHlBoe6Bw88ji8L4cnjzuWGS:ZiRgfVq67YSS5l96Bw88jhD
TLSH
T16CF1007894488B7F74B6776CAC6888316AB2017B7BBF68C350B54484055CF3482F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs-1.js
Size 8KB
SHA256 f155f6c8bcdce323330ccdb25b465230e50ef1899991aff56148c53d3925fda4
MD5 2f41377a6c07eaab1be29618d93c1b36
SHA1 e18a3f3206e27cf50639a10ac3459e35b8ec13f4
SHA512 1ea3eec3a23844d12b4173c206eac4a81c737fa2fcf3b3e23893095bf4c6822249212de4129f8a9491835895488875cbd587c1a039168ba720d457c7bbcdfd70
SSDEEP 96:xHTFTUfqGqgfQq6ObzS5YSSlc+dv9jTnLWRrNRBoeVnBw88//eKi8L4cnjzuWGS:ZzRgfQq67YSSaXRf9VnBw885hD
TLSH
T16702ED78A0488B7F74F2366CBC644D7169A2023B7BBFA8D354B94494055CF3481F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 6KB
SHA256 cef5aae3ca11287b0e56b33feb2ff6509b0bac0469135f97f00d7361ca2f6e9c
MD5 16f4159ae562caa75cc13528a38dda8f
SHA1 5226d74181a92eed3419c6600831bb56ec810c49
SHA512 e349649d1227a6ca07c213f98bc302292c7bf718fa2c410aee257e0f9a7fa5ee756b3ed8889f7fd7f5c5cb2e422af161ff229a9d523eff4e2ac5783456537b84
SSDEEP 96:xHTUTUfqGqgfVtk1zSMSSl5dv9jXbnLHlBoe6Bw88H8L4cnjzu/:ZiRgfVtkFSSHl96Bw88UM
TLSH
T19CE11F789408CB7F74B677ACAC688C716AB2013BB7BF68D650B55885050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 6KB
SHA256 7f2baa91ba0599c97345b94a00d90a8008287d6b70631eefadec30f4b8edcdb1
MD5 76c60dfaa586c489a8b07f1bf3ce4f3c
SHA1 28c81cd62db43a29285b63cd79b0f52341af5b40
SHA512 388d9aba3a5c26c158c5b9a42176f1812d653fe9a86e7a3df3ca41c6f06ed7c4bfdf8cd5d9de58971457c1f3ca17948ed70343a8326236b3c165753e3f24f959
SSDEEP 96:xHTUTUfqGqgfVq61zS5YSSl5dv9jXbnLHlBoe6Bw88H8L4cnjzu/:ZiRgfVq6kYSSHl96Bw88UM
TLSH
T1E1E110789418CB7F74B6776CAC688C716AB2013BB7BF68C650B55884050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b20cd439b2c8b2e621ce59f15135cdeae00545a3b6ac78e8d0b94619cd8f9a30
MD5 5aa8c1d75f91d2b02906c5b91d638496
SHA1 d9e5d08322b2a02f1043aa99874386e9296ff642
SHA512 b3b0db48079e9fa9872e34c03a4d49694213132e845b9284b935b8d055b0e0f9029aafadf07b0332d1a9c47a48273b748ae1bbd5951a071ed08d9ee8e69a090a
TLSH
T15F31E80E552F3DED6675A03AC54BAAB20BD010631C7CB0A0E8D54B0E07B87D5B1DE552
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8cf6fd9976f5e5dcc1d111316bf3779880c10cb519b386285f8fae888a27a7df
MD5 9845e589c97fffca69ffa9d6f4b18ef0
SHA1 56f64e99126e1b6a6838697775f5c4c51ada1a02
SHA512 fe41b0d458203274d4346697895fe58960b29f3d5feb2cb12568e4ffa556a3f2a023cb31934c365ad5374f530ad51d058b1319bfac15e71c52f375c980f358b5
TLSH
T1AD21DA8316376FF7B541B23AC19C5FF19A841A278CA474B0D19C5B0745A9358B388815
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 1d14ee130d1bbc9aaaa47cde4ab13d2a492dc1a8a6ca91d4c61e89e9bf11f3e3
MD5 cd3b6366c2996261abeccef8a2a2aa70
SHA1 f3ba0404888aaa643f57303b0864f0bc9245ac70
SHA512 a1ccad96fac030534785920276c0d20bb70b982462588b0eed416c69b011b882419f763d8a3f1bea74e8eba35d11e1aadc2358b0bb1f0672345f255c1c9557a7
TLSH
T1FF31D61A2D2F3EFA2676D07685D766B20BF400725D79A4E0C08C6B0A0B7C6C9B16A595
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

netrasa.PNF

Path C:\Windows\INF\netrasa.PNF
Size 22KB
SHA256 403f776d24e9f3a872b9e2afbc85c1a78fbe4dec871275595eae217a9be41649
MD5 910e64613fcb94f3de7ee9f92d822414
SHA1 fe7b5abd65e22920f9f75f4feb340ceace59013c
SHA512 6a1835944c060572dc9a2d92cfabb3251fc6f1de5e0f7e626fd385db50d395362a3c85039fa5d6be59bb9b3f72db1c3195a76edc3918ba1a8333ab76ffaa5e0d
SSDEEP 384:/68U5C0fE6hq/4S4Fa4ToF48mq+HGDNGourG9qhQ3qnoA5xRx2rPQ:/45C0fE6hq/4S4Fa4ToF48mq+HGDNGoG
TLSH
T1BBA2AA10FBD99908F6F68E345CF521E5062EBC816C02DF5F1190735E9832B85EAF1E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3EA8.tmp

Path C:\Windows\Installer\MSI3EA8.tmp
Size 81KB
SHA256 4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621
MD5 fccdc45ca17e5180b40efc28052bac39
SHA1 cecb5a7e8807e619956183897a64930ce56294d6
SHA512 67a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce
SSDEEP 1536:gkgmLbYQ861W0EPIIjC5kjGpeSyn7ejhPi/NULSRLnthRQGS:gk1j8yKCe6eb7nlULSRLn5QG
TLSH
T150837D2533A48039D5B61A32B974D2725F3EB8312B70C4CEB7464A6E5E70691BAF7313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBAF0.tmp

Path C:\Windows\Installer\MSIBAF0.tmp
Size 418KB
SHA256 f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40
MD5 67f23a38c85856e8a20e815c548cd424
SHA1 16e8959c52f983e83f688f4cce3487364b1ffd10
SHA512 41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d
SSDEEP 6144:7P8N0LW3qa54J725UZnEuru4dtN5dHak+KNlA0ZBoWENFw2IzuJAgXrCUlZy1O9a:78mLPa5S72qVRLHak58py0s
TLSH
T1AE94064177E55030F2B76B31AAB989224E7BBCB1A9B6C00FD3854A0F5971A40FA35773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC7C1.tmp

Path C:\Windows\Installer\MSIC7C1.tmp
Size 148KB
SHA256 6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164
MD5 be0b6bea2e4e12bf5d966c6f74fa79b5
SHA1 8468ec23f0a30065eee6913bf8eba62dd79651ec
SHA512 dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b
SSDEEP 3072:oitbxNeB4Ms+eGDIEZvtFg1Ass+wrQiVntHY:vTKME3eWhY
TLSH
T13CE35B0273D09071E5AF027A2574AA251B7FBC72DB7189CBF7980A5E59706C0BE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICFF3.tmp

Path C:\Windows\Installer\MSICFF3.tmp
Size 209KB
SHA256 5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b
MD5 0e91605ee2395145d077adb643609085
SHA1 303263aa6889013ce889bd4ea0324acdf35f29f2
SHA512 3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be
SSDEEP 3072:nAhQzCk1xLP3JBy9H00pSx71cIUrdfcr1DZJq8aK:AhQzCkXLP5o/Sks9LaK
TLSH
T1F0246A1176D58035E1FB0272467AAB0206BEBEB15B72CDCF6BD84D4D1A349C1A73A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 285KB
SHA256 3f67dcc81c122512bc09cd8752ccdcef972daa94517f8ce7e3c09f3732d1089a
MD5 a73a83c295488d39e8fad968b9f9a124
SHA1 e9d21fa766383722ee5e9834bd018cc377a9d90f
SHA512 ad3d4e1876db7ca1cfd3764f7b375b3d4c2fee590661808da1e0b0f8abb0030addb2041347a189e9c428edf02f8e8ad3ad888d1e60d2b00118f22102fd37139e
SSDEEP 1536:Y35aXBbe9F3bRqfhTRPsQoXVgdFm2bs5aFS1yyy4/dMTDPSrdu97OLRJTX:DWxvWs
TLSH
T1F754EF6E07FB0932A5488403B371AFFD69967683B9C4F704762FD1366BC3D998B16284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 156KB
SHA256 e20c1e55b1bf3d559dccbbab5b34cd46ae3d5dfee9bf045ed947e3c433ca72d1
MD5 f1547a244520f18e5ffb6e184bfcc37b
SHA1 bd27ade34ae97a74eca5672c836454881b676f43
SHA512 acc0fe324889d32917da55db3bc2f8a5485af4e3cfdc87b3f1e69c62f885c2d220760128e63b5870c7616d89adc8924d6038574e62e2b23ee3f6f1c6c8fba681
SSDEEP 1536:SgEjIOPe+9CeuBDpGa6KwZEYSSyOSd5ze2mmmUm+YSpJVHSGyf02KSkqnmEi0OaM:0l8pj
TLSH
T195F3DC19241E51F51D6223822E9D3BC7A7CF47857BE8099DB264BA3CEB4784F43319E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
Size 147KB
SHA256 eddc611504f352b1806d702f5b6c477e85a3043e72f4a1c2184cd640beee1bb6
MD5 1632a9bea0ec45e522014488ce994d4c
SHA1 adf6841a2c4178a61051b173bd2193a30e2018ed
SHA512 e58f0d9b0768944fbd9017fc889a0430f4aca9f3c3e1033b3b4c981fd593c65bbac294134489232776aca897ec3c9d9768aa7b70049354368b4010a92bc8013f
SSDEEP 1536:Rqyz2xs+S9SKSyBSVcuGrGH1GCGH2+6QaeqYCdMeCAARakoJeyQylYaxUrea2f+4:mtEucY
TLSH
T1A2E30419201E51F51D626382169C378BF3DF4F852BA8096DF664BA2CEB8744F83359E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\System32\LogFiles\setupcln\diagerr.xml
Size 10KB
SHA256 b57b0b8a7513f7d7b96f5ed8d9c431d4e8255b84b83744c6d187759074ae917a
MD5 8dee95a41fc7928ec423765f88f1ffd2
SHA1 6ccef2f599d968374e9ef8e3c1d19ce66266a572
SHA512 c952fb0515fff08883c2914dfc142b64f4c0acd56983293d91b0d1f2ac5a5c9b38d0ba2e0e7e5ec8bb4627a643881002744f1015620b30b7af683dc6e5a2b9c9
SSDEEP 192:53gbq3gbHA83gbHOKATpAOa64qj5QS3gbD:53Iq3It3IeVD3ID
TLSH
T19E225B39B1992FB71C5406A9DFD038C26F80A6794116A03795C8FDAFB276082F9B07DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\System32\LogFiles\setupcln\diagwrn.xml
Size 9KB
SHA256 63a505045b1d4549428a469bf00b0f83aaf58cfd9eb2c32b24f17336e323ab31
MD5 ef82b304067edcf3cf990a42de93b695
SHA1 a2a2af4015e81562bab4454232bbcb69708f5cd9
SHA512 8f5e17ed20bd033370220c7dc9f1373cd9aa79d3fe3b73cef1dbf0134f8705997f1287427c03d87e16a5932855a553501988b3c43b4ca2329d4d8f153dbe5d41
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbnt:53gbq3gbq3gbq3gbq3gbt
TLSH
T1B9127229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupact.log

Path C:\Windows\System32\LogFiles\setupcln\setupact.log
Size 13KB
SHA256 7c1ae8b3ceaca6a12d24fee28f9a4346f7fd50722d6ffd77b63513d8fe601b30
MD5 018977332f0174ffeb2388dea9a9a05a
SHA1 ddb005d07b52fbba0400e33f40d0b4314ad74ade
SHA512 caa0957009081313e2a81322152288550efe221463eeea3a47b4da4a2f59616c896badda7395bdabff19be1a6fc555e719eb15646974973102ef06089ee876e7
SSDEEP 192:APGaduwpe3TKDFmIb3aKF+KXEK/FOJb05KitKSFXKvkJb2swMdO6qj5O2qpXAGxV:uS6ctW+CEC4AVtPVykk7bMv
TLSH
T18652AB3607E961B3780BE60DF6CD6D8C6DA77A5421A89144BAFF440B7F927408638CF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1162018605\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1162018605\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1200124096\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1271097529\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1339993488\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1433281151\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1677572580\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1677572580\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_1827638496\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5080_837922931\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

memory/356-4227-0x000001FB63A00000-0x000001FB63B77000-memory.dmp

Download

memory/356-4226-0x000001FB63A00000-0x000001FB63B77000-memory.dmp

Download

memory/788-7202-0x000000001BA50000-0x000000001BA7C000-memory.dmp

Download

memory/788-7203-0x0000000001640000-0x000000000164E000-memory.dmp

Download

memory/1680-4304-0x00007FF60C510000-0x00007FF60CB3C000-memory.dmp

Download

memory/2252-7642-0x00007FF977EF0000-0x00007FF977F2A000-memory.dmp

Download

memory/2252-7641-0x00007FF9740F0000-0x00007FF97418B000-memory.dmp

Download

memory/2252-7640-0x00007FF979890000-0x00007FF9798A5000-memory.dmp

Download

memory/3652-7688-0x000001C180030000-0x000001C18003A000-memory.dmp

Download

memory/3652-6431-0x000001C180010000-0x000001C18001E000-memory.dmp

Download

memory/3652-7683-0x000001C180090000-0x000001C1800AC000-memory.dmp

Download

memory/3652-7658-0x000001C100130000-0x000001C100138000-memory.dmp

Download

memory/3652-7685-0x000001C180110000-0x000001C18012A000-memory.dmp

Download

memory/3652-7686-0x000001C104450000-0x000001C104458000-memory.dmp

Download

memory/3652-7687-0x000001C104AE0000-0x000001C104AE6000-memory.dmp

Download

memory/3652-7820-0x000001C104450000-0x000001C104458000-memory.dmp

Download

memory/3652-7916-0x000001C180110000-0x000001C18013A000-memory.dmp

Download

memory/3652-7917-0x000001C180110000-0x000001C180134000-memory.dmp

Download

memory/3652-6432-0x000001C1805C0000-0x000001C180748000-memory.dmp

Download

memory/3652-7684-0x000001C180020000-0x000001C18002A000-memory.dmp

Download

memory/3652-6430-0x000001C1800D0000-0x000001C180108000-memory.dmp

Download

memory/3652-6429-0x000001C180000000-0x000001C180008000-memory.dmp

Download

memory/3652-6419-0x000001C100780000-0x000001C100CA8000-memory.dmp

Download

memory/3652-6418-0x000001C180000000-0x000001C18000A000-memory.dmp

Download

memory/3652-6417-0x000001C100190000-0x000001C100243000-memory.dmp

Download

memory/3652-6416-0x000001C100170000-0x000001C10018C000-memory.dmp

Download

memory/3652-6409-0x000001C180260000-0x000001C180422000-memory.dmp

Download

memory/3652-6390-0x000001C180040000-0x000001C180086000-memory.dmp

Download

memory/3652-6371-0x000001C1676F0000-0x000001C167712000-memory.dmp

Download

memory/3652-7918-0x000001C1800B0000-0x000001C1800CC000-memory.dmp

Download

memory/3652-7919-0x000001C180090000-0x000001C18009A000-memory.dmp

Download

memory/3652-7920-0x000001C180160000-0x000001C180186000-memory.dmp

Download

memory/3664-5158-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5161-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5173-0x0000028560540000-0x0000028560541000-memory.dmp

Download

memory/3664-5170-0x0000028560550000-0x0000028560551000-memory.dmp

Download

memory/3664-5167-0x0000028560550000-0x0000028560551000-memory.dmp

Download

memory/3664-5168-0x0000028560540000-0x0000028560541000-memory.dmp

Download

memory/3664-5166-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5165-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5164-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5163-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5162-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5184-0x0000028560680000-0x0000028560681000-memory.dmp

Download

memory/3664-5176-0x0000028560480000-0x0000028560481000-memory.dmp

Download

memory/3664-5188-0x00000285607A0000-0x00000285607A1000-memory.dmp

Download

memory/3664-5187-0x0000028560690000-0x0000028560691000-memory.dmp

Download

memory/3664-5186-0x0000028560690000-0x0000028560691000-memory.dmp

Download

memory/3664-5157-0x0000028560900000-0x0000028560901000-memory.dmp

Download

memory/3664-5140-0x0000028550340000-0x0000028550350000-memory.dmp

Download

memory/3664-5124-0x0000028550240000-0x0000028550250000-memory.dmp

Download

memory/3664-5156-0x0000028560900000-0x0000028560901000-memory.dmp

Download

memory/3664-5160-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3664-5159-0x0000028560920000-0x0000028560921000-memory.dmp

Download

memory/3924-4820-0x00007FF60C510000-0x00007FF60CB3C000-memory.dmp

Download

memory/4180-2979-0x000001EE69090000-0x000001EE69190000-memory.dmp

Download

memory/4180-2653-0x000001EE69440000-0x000001EE69540000-memory.dmp

Download

memory/4180-1773-0x000001ED402D0000-0x000001ED403D0000-memory.dmp

Download

memory/4180-1782-0x000001ED40000000-0x000001ED40100000-memory.dmp

Download

memory/4180-1808-0x000001EE532A0000-0x000001EE532C0000-memory.dmp

Download

memory/4180-1809-0x000001ED41920000-0x000001ED41940000-memory.dmp

Download

memory/4180-1881-0x000001ED41D00000-0x000001ED41E00000-memory.dmp

Download

memory/4180-1880-0x000001EE54AE0000-0x000001EE54BE0000-memory.dmp

Download

memory/4180-1902-0x000001ED40CF0000-0x000001ED40DF0000-memory.dmp

Download

memory/4180-2098-0x000001EE551E0000-0x000001EE552E0000-memory.dmp

Download

memory/4180-2112-0x000001EE65650000-0x000001EE65750000-memory.dmp

Download

memory/4180-2103-0x000001EE65550000-0x000001EE65650000-memory.dmp

Download

memory/4180-4029-0x000001EE68BF0000-0x000001EE68CF0000-memory.dmp

Download

memory/4180-3604-0x000001ED402D0000-0x000001ED403D0000-memory.dmp

Download

memory/4180-3606-0x000001ED41530000-0x000001ED41630000-memory.dmp

Download

memory/4180-3358-0x000001EE68BF0000-0x000001EE68CF0000-memory.dmp

Download

memory/4180-3361-0x000001EE68BF0000-0x000001EE68CF0000-memory.dmp

Download

memory/4180-3018-0x000001EE69340000-0x000001EE69440000-memory.dmp

Download

memory/4180-2101-0x000001EE65650000-0x000001EE65750000-memory.dmp

Download

memory/4180-3019-0x000001F068E10000-0x000001F068F10000-memory.dmp

Download

memory/4180-3020-0x000001F068E10000-0x000001F068F10000-memory.dmp

Download

memory/4180-3021-0x000001EE65450000-0x000001EE65550000-memory.dmp

Download

memory/4180-3022-0x000001EE65550000-0x000001EE65650000-memory.dmp

Download

memory/4180-3016-0x000001EE54BE0000-0x000001EE54CE0000-memory.dmp

Download

memory/4180-2999-0x000001EE69090000-0x000001EE69190000-memory.dmp

Download

memory/4180-2839-0x000001EE54740000-0x000001EE54840000-memory.dmp

Download

memory/4180-2749-0x000001EE65550000-0x000001EE65650000-memory.dmp

Download

memory/4180-2742-0x000001EE551E0000-0x000001EE552E0000-memory.dmp

Download

memory/4180-2687-0x000001ED40B30000-0x000001ED40B50000-memory.dmp

Download

memory/4180-2097-0x000001EE551E0000-0x000001EE552E0000-memory.dmp

Download

memory/4180-2651-0x000001EE69440000-0x000001EE69540000-memory.dmp

Download

memory/4180-2521-0x000001EE69440000-0x000001EE69540000-memory.dmp

Download

memory/4180-2523-0x000001EE69440000-0x000001EE69540000-memory.dmp

Download

memory/4180-2242-0x000001EE54740000-0x000001EE54840000-memory.dmp

Download

memory/4180-2099-0x000001F068E10000-0x000001F068F10000-memory.dmp

Download

memory/6556-16818-0x000002B6D1680000-0x000002B6D1688000-memory.dmp

Download

memory/6556-16821-0x000002B6D16E0000-0x000002B6D16F4000-memory.dmp

Download

memory/6556-16820-0x000002B6D1CB0000-0x000002B6D1D58000-memory.dmp

Download

memory/6556-16817-0x000002B6B70A0000-0x000002B6B70CC000-memory.dmp

Download

memory/6784-13387-0x000002A0D5BD0000-0x000002A0D5BEA000-memory.dmp

Download

memory/6784-11442-0x000002A0CE9C0000-0x000002A0CE9D4000-memory.dmp

Download

memory/6784-11477-0x000002A0CEC00000-0x000002A0CEC2C000-memory.dmp

Download

memory/6784-13389-0x000002A0D5AF0000-0x000002A0D5AFA000-memory.dmp

Download

memory/6784-13401-0x000002A0D7140000-0x000002A0D7268000-memory.dmp

Download

memory/6784-13404-0x000002A0D5930000-0x000002A0D5938000-memory.dmp

Download

memory/6784-13407-0x000002A0CEC30000-0x000002A0CECE2000-memory.dmp

Download

memory/6784-11444-0x000002A0CE800000-0x000002A0CE80A000-memory.dmp

Download

memory/6784-11443-0x000002A0CE9E0000-0x000002A0CE9F6000-memory.dmp

Download

memory/6784-12932-0x000002A0D5AD0000-0x000002A0D5AE2000-memory.dmp

Download

memory/6784-12931-0x000002A0CEB30000-0x000002A0CEB3A000-memory.dmp

Download

memory/6784-13384-0x000002A0D5810000-0x000002A0D581A000-memory.dmp

Download

memory/6784-11441-0x000002A0CE960000-0x000002A0CE978000-memory.dmp

Download

memory/6784-13377-0x000002A0D5B20000-0x000002A0D5B4E000-memory.dmp

Download

memory/6784-13373-0x000002A0CEB50000-0x000002A0CEB5E000-memory.dmp

Download

memory/6784-11440-0x000002A0CEB70000-0x000002A0CEBB4000-memory.dmp

Download

memory/6784-11439-0x000002A0CE990000-0x000002A0CE9BE000-memory.dmp

Download

memory/6784-11445-0x000002A0CEBC0000-0x000002A0CEC00000-memory.dmp

Download

memory/6784-11453-0x000002A0CE810000-0x000002A0CE818000-memory.dmp

Download

memory/6784-11630-0x000002A0D5B50000-0x000002A0D5BC6000-memory.dmp

Download

memory/6784-10358-0x000002A0CE610000-0x000002A0CE618000-memory.dmp

Download