Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
70s - max time network
71s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 18:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
encryptor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target encryptor.exe
- Size 235KB
- Sample260924-wtaaaasxhs
- SHA256 fb95c1329a3b5434636a985775b10095b38113605c754b1069725ee1103057f9
- MD5 57b46b4f62bc6e04a42b277005dfece6
- SHA1 c0892026e97dab08670aa22f4c8dd8f421d56459
- SHA512 d38a7124db18107d6e3d58bef07ee9aec959d812e3caf67415e132efd4cca99db2ab71e4ded84c8b8bbd026766e09ae685c356c63c2dc62f719b2bd1cb1fc1b3
- SSDEEP 6144:6t4KndG5MXZnEiO3IEinIYN2GUYVG7xj:iEb3qXN2WVy
- TLSH T195348E19B7A50CFAE5B7C179CD424946DB737C4647A0DBDF07A00A928E13AE09E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" encryptor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" WindowsUpdateService.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" encryptor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" WindowsUpdateService.exe - Renames multiple (1680) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3660 powershell.exe 5772 powershell.exe 3660 powershell.exe 5772 powershell.exe - Deletes itself 1 TTPs 1 IoCs
pid Process 5932 WindowsUpdateService.exe - Executes dropped EXE 1 IoCs
pid Process 5932 WindowsUpdateService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" WindowsUpdateService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1" WindowsUpdateService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features WindowsUpdateService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" WindowsUpdateService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" encryptor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1" encryptor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features encryptor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" encryptor.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "\"C:\\Windows\\Tasks\\WindowsUpdateService.exe\"" encryptor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "\"C:\\Windows\\Tasks\\WindowsUpdateService.exe\"" WindowsUpdateService.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Tasks\WindowsUpdateService.exe WindowsUpdateService.exe File created C:\Windows\Tasks\unlock.key WindowsUpdateService.exe File created C:\Windows\Tasks\README.txt WindowsUpdateService.exe File created C:\Windows\Tasks\WindowsUpdateService.exe encryptor.exe File opened for modification C:\Windows\Tasks\WindowsUpdateService.exe encryptor.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5396 sc.exe 756 sc.exe 5116 sc.exe 3464 sc.exe 2520 sc.exe 3972 sc.exe 2348 sc.exe 3008 sc.exe 4636 sc.exe 2256 sc.exe 4556 sc.exe 5072 sc.exe - Executes a command shell one-liner 1 TTPs 19 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4316 cmd.exe 5016 cmd.exe 5640 cmd.exe 6052 cmd.exe 4808 cmd.exe 2496 cmd.exe 1208 cmd.exe 4656 cmd.exe 2508 cmd.exe 1776 cmd.exe 116 cmd.exe 3776 cmd.exe 816 cmd.exe 1048 cmd.exe 5032 cmd.exe 896 cmd.exe 644 cmd.exe 2696 cmd.exe 2492 cmd.exe - Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|3" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.5 = 5265706169725461736b46756c6c7265706169725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b52656d6f7665696e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b436f6e6669677572656c696768745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c69656e747570646174655461736b436c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b53747265616d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b437265617465776f726b696e67636f6e66696775726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b55706461746566696e616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74735c22203a207b205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e6976657273616c426f6f7473747261707065725c22203a207b205c224576656e74735c22203a207b205c224170706c69636174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374456d6265646465645369676e61747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616c63756c617465506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436c69656e744361624d616e616765725c22203a207b205c224576656e74735c22203a207b205c225461736b557064617465436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253747265616d4361625c22203a207b205c224576656e74735c22203a207b205c22446f776e6c6f616453747265616d4361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225472616e73706f72745c22203a207b205c225375624e616d657370616365735c22203a207b205c224578706572696d656e74616c5472616e73706f72745c22203a207b205c224576656e74735c22203a207b205c22436162735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c224576656e74466c61675c22203a20323536207d207d207d2c205c225472616e73616374696f6e616c46696c654f7065726174696f6e735c22203a207b205c224576656e74735c22203a207b205c224170706c794368616e6765735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c22436865636b42696e6172696573466f72436f7272757074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e73706f72745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f776e6c6f61644361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446961676e6f7374696373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c6563746f725c22203a207b205c224576656e74735c22203a207b205c2253746172745472616365436f6c6c6563746f725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446f6373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74416374697669746965735c22203a207b205c224576656e74735c22203a207b205c2241637469766974794c6f67456e7472794372656174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e74727953657453746174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963654163746976697479526573756c745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674f6e436f6e74656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e717565756541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d69745175657565496e7365727441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d697451756575654469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963655075626c6973685369676e616c4173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674173796e635461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241637469766974794c6f6744697363617264466f72446f63756d656e744368616e67655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67547269676765724173796e635461736b576f726b65725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654c6f61644173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e697446696c65506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565417070656e644173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565577269746541637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756552656d6f76654173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655772697465446f63756d656e74496e666f4865616465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756554727944656c657465456d70747946696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e7365727441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e717565756541637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674372656174654c6f675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67536176654e657746696c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654c6f63616c4e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e674e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224170694f70656e41637469766974794c6f675769746853747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6c6c6162436f726e65725c22203a207b205c224576656e74735c22203a207b205c22436f6175746847616c6c65727955736572437265617465416374696f6e4875624c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436f6175746847616c6c65727955736572437265617465466c65784c69737446726f6d536e617073686f745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436f617574686f725570646174654c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f617574686f72476f546f43757272656e744c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795573657252655265676973746572436f6e6e65637469766974794368616e67654e6f7469667949664e65636573736172795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6443686174427574746f6e497356697369626c654e6f7744617461706f696e745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572436c6f736553696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64497343686174417661696c61626c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665644173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72734265666f72654173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279496e6974464d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279436f617574686f72577261707065725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64436f61757468696e6757697468416c6c4775657374734f724d697373696e67456d61696c456469746f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476f546f4c6f636174696f6e416374696f6e487562416374696f6e4a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465417574686f724c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465456d61696c416e64436861745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6e7461637443617264416374696f6e487562416374696f6e53686f77436f6e74616374436172645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279557365724f70656e53696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456d61696c416374696f6e487562416374696f6e53656e64456d61696c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6453657456616c75655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224d736f494d5365727669636573536642506861736531496d70726f76656d656e7473456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f757455736572496e697455495c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d5365727669636573497357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664257616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f494d536572766963657353664357616343686174456e61626c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617455494d6f64656c4f6e55494576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617443616c6c6f7574557365724f6e5061727469636970616e744c6973744368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486973746f727955585c22203a207b205c224576656e74735c22203a207b205c22556e7365656e416374697669747943616c6c6f757450726573656e7443616c6c6f75745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224163746976697479506167654d616e6167657252656769737465725669736962696c697479436f6e74726f6c6c65725c22203a207b205c OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\00188019C7988092 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000069ad87d2da169441a15fc050912a24f500000000020000000000106600000001000020000000baba1996e1a8648d043e68ba1037f8f7f0c9115af039737efc57fca3014e0adc000000000e8000000002000020000000a35833666b25471ed61b4e4098418e17a6ce31e5b00b8a3c02b1a43b8efe424c800000001e701e28cc92564dacc5f72e70c8a4b28bb69296ebbf259ff0c7a21c9c6828396a20e76ed9990fc01d421699cd5ad96e770c0b856d65e0d3967df51b315e52037a694a80914f83f6875af65db1e44e6da7089e3aaa3e399a8af2667a3d3b538863ed91050b8484d0332ed35ae04334de83aec49352401ae89b2897bba636174940000000d994196584bcd7ceb949190a6fbeb601d497b55e74120329cfc77646328329b2e87c264a3fc19c7d1c980926c3ecabf4097f19f63e1e30ec2d059d8911103357 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.1 = 73732e5175657279496d70726f76656d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e41697253706163652e436f6d62696e654261636b656e6444696d656e73696f6e436f6d6d616e6473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e4c6963656e73654665617475726573456e61626c65644f72436865636b222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175674c6f6f702e576f726b666c6f7744697361626c65642e5265706c6163654f626a656374576f726b666c6f77222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4175676c6f6f702e4f66666963654167656e742e456e61626c65436f6e766572736174696f6e5772697465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4358452e48696464656e466f6e74734d736f466f6e745069636b657257696e3332222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e416c6c6f7753657456616c756573576974686f7574457863656c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e4368616e6765476174652e46436c6561724d6f6e696b6572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e436f6c6c656374536861706550726f7073427567466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e4d6170436861727459656c6c6f7744617461222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e5069766f744368617274496e7665727446696c6c427567466978222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e43686172742e536c69646553686f7748696465546f6f6c74697073222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d61785265747279436f756e74222c20225622203a2022696e7433325f747c313422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070564d6178526574727954696d654c696d6974222c20225622203a2022696e7433325f747c363030303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e417070565265747279496e74657276616c222c20225622203a2022696e7433325f747c3230303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655265666163746f72656453687574646f776e50726f636573736573222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734164646f6e222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734f6e557064617465427573696e657373222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5573655465616d734f6e55706461746550726f506c7573222c20225622203a20227374643a3a77737472696e677c656e61626c656422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e436c69636b3252756e2e5775536564696d656e7452656d6564696174696f6e2e546172676574696e67222c20225622203a20227374643a3a77737472696e677c7b5c2264656661756c745c223a5c226e6f6e655c222c5c2234393233353066362d336130312d346639372d623963302d6337633664646636376436305c223a5c2261756469745c227d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e4164646974696f6e616c4461746154797065456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e426c6f636b466565646261636b457870657269656e636542617365644f6e5072697661637953657474696e6773222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e426c6f636b537572766579457870657269656e636542617365644f6e5072697661637953657474696e6773222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e436f686572656e6365457870657269656e6365456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e446961676e6f73746963735341532e55706c6f6164657254797065222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e456e61626c65466565646261636b5632536368656d61222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e466565646261636b446973616d626967756174696f6e53637265656e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e486f73746564466565646261636b5461736b50616e65222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e486f73746564537572766579456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e437573746f6d6572566f6963652e536173466565646261636b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446961676e6f73746963732e44697361626c654661737446696c746572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e414354522e5468726f74746c654361706163697479222c20225622203a2022696e7433325f747c313022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e414354522e5468726f74746c65496e74657276616c4d736563222c20225622203a2022696e7433325f747c3130303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4261636b7374616765496e6170704e61765632456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e49735265706c7954696d657374616d704c6f6767696e67456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e4e657743617264426f7264657273222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e4a53476174652e50616e65546162466f6375734669786573222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d6f6465726e436f6d6d656e74732e50726f636573734368616e676573496e766f6b65456c7365506f7374222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4d736f2e4f757453706163652e446570726563617465536574496d6167654173796e63222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4f666669636553746172742e466978466f7241444f33393032343239222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4368616e6765476174652e4f757453706163652e536861726564576974684d652e44697361626c65446f63756d656e74735265717565737449665573696e674167674d7275222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e436865636b41637469766974794c6f67546f456e61626c654d656e74696f6e73222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e456e61626c655369746573467269656e646c7950617468222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e486973746f72794c6567616379436c65616e7570456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e486973746f7279556e696f6e466978456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e486f6d65506167652e436f6c6c61707369626c65536c616273222c20225622203a2022696e7433325f747c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e496e4170704e61762e43726561746552656e616d6544656c657465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4d736f2e4f666669636553746172742e466978466f7241444f333838363036375632222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e4f44656c74612e53747265616d4d6f6465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e446f63732e576f7069222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e4361636865457870697279496e4d696e222c20225622203a2022696e7433325f747c37323022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e436c69656e74436f6e66696775726174696f6e5570646174654576656e74222c20225622203a20227374643a3a77737472696e677c7b205c2244656c74614c6f67456e61626c65645c22203a2066616c73652c205c2246756c6c5365744c6f67456e61626c65645c22203a2066616c73652c205c2246756c6c5365744672657175656e63795c22203a20313030207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e436f6e666967496444656c696d69746572496e4c6f67222c20225622203a20227374643a3a77737472696e677c3b22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e436f6e6669674c6f67546172676574222c20225622203a20227374643a3a77737472696e677c64656661756c7422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e44697361626c65436f6e6669674c6f67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4543532e456e61626c65536d61727445546167222c20225622203a2022696e7433325f747c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e454353546573742e746573747661726961626c65222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e46413030303030303132342e457863656c4167656e7444656e736974794c4b4756657273696f6e222c20225622203a20227374643a3a77737472696e677c312e6c617465737422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e46413030303030303132342e457863656c4167656e7444656e7369747956657273696f6e222c20225622203a20227374643a3a77737472696e677c312e32303236303932302e31322e3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e46413030303030303132342e457863656c4167656e7444656e7369747956657273696f6e54657374222c20225622203a20227374643a3a77737472696e677c322e32303236303931342e33392e3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e496e7369676874732e456e61626c65436f6d706c65785069766f745461626c65496e5069766f745461626c655265636f6d6d656e646572222c20225622203a20224d736f3a3a416e79547970657c75696e7431365f747c323b626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e496e7369676874732e456e61626c655069766f745461626c655265636f6d6d656e646572222c20225622203a20224d736f3a3a416e79547970657c75696e7431365f747c323b626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e496e7369676874732e5069766f745461626c655265636f6d6d656e64657252616e6b65725632222c20225622203a20224d736f3a3a416e79547970657c75696e7431365f747c323b626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e457863656c2e4e616d656453686565745669657750657273697374656e6365222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e436f6e66696746657463684d616e61676572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e44796e616d6963447069222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e457870466972737453657373696f6e5461736b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e4665617475726551756572794c6f676765722e456e61626c655374617469634c6f6767696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e52616e646f6d464736222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e4578706572696d656e746174696f6e2e5472696d41707049644c697374546f4665746368222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4368616e6765476174652e416c7761797346616c6c6261636b466f7253796e634261636b6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4368616e6765476174652e44657072656361746546696c65536572766572496e666f54797065222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4368616e6765476174652e456e61626c654261636b67726f756e6455706c6f6164222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4368616e6765476174652e5573654e65774d736f446f6354656c656d65747279496e697450617468222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e436865636b5265766973696f6e53747265616d457175616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e436f6c6c616250726f7053746f726543616368655265736574436865636b6572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e436f7079546f43616c6c6261636b456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e4373694c696d6974656446616c6c6261636b546f486c696e6b222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e44534c49422e456e61626c654c6162656c73556e757365644f72436c6561726564436865636b222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e446570726563617465436865636b5374617274735769746846696c654e616d65457869737473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e46696c65494f2e446973616d626967756174654373694e6574776f726b436f6e6e65637469766974794572726f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t|0" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ETag = "std::wstring|\"r0+QF9B8iB+SasHHXNGhoQ82F+gNiH6UNTiRj0O1QmA=\"" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.4 = 66742e4f66666963652e5365676d656e746174696f6e2e436f70696c6f7446726f6e746965722d53746167696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e436f70696c6f7453616e64626f78222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e46617374465445222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e46726f6e7469657241756469656e6365222c20225622203a20227374643a3a77737472696e677c4e6f6e6522207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4d53495442697a63686174416c6c6f776c697374222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4d6f636861222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e4f584f416c6c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e50657270657475616c4c6963656e7365222c20225622203a20227374643a3a77737472696e677c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e5365676d656e74222c20225622203a20227374643a3a77737472696e677c4e4f4e4652444322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e56657273696f6e506172746974696f6e222c20225622203a20227374643a3a77737472696e677c57696e3332416e64726f6964486f7422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5365676d656e746174696f6e2e576f7264436f70696c6f74446f67666f6f64222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e416c6c6f775a65726f4c656e677468536561726368537472696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f436f727265637455492e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f446973636f7665722e4275674669786573466f7252657472794661696c65645265717565737473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f446973636f7665722e4c696d6974546f4f6e654175746f446973636f766572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4175746f446973636f7665722e4f6e6c795573654874747073222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e426f6f7449646c655468726f74746c6572222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4275674669782e506572736f6e61436f6e74726f6c4261636b67726f756e64436f6c6f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4368616e6765476174652e44656c617943757272656e745549416374697665506c616365557064617465222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4372634261736564556964222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e43726974697175652e44697361626c65644c616e677561676573222c20225622203a20227374643a3a77737472696e677c6a612c7a6822207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e43726974697175652e4c6f67496e7465726e616c4e616d65416e645072696f72697479222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e456469746f72536572766963652e557365496e737472756d656e746174696f6e417069222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f72744865647769675558222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4772617068496d706f7274496e73657274416c6c4f626a6563747356696577222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e47726170686963732e4368616e6765476174652e5570646174655461626c65426f756e6473466f72547970696e67222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4967782e456e7375726545326f4d6f6e696b65724166746572456e7375726545326f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4e6577456e737572655549444c6f676963222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4f6666696365496e7369646572526567697374726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e416c6c6f7746696e6450656f706c655573616765496e41744d656e74696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e4175746f436f6d706c6574652e46696e6450656f706c65537570706f7274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e4669784e6f6e526566436f756e7465644d736f506572736f6e6173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e4261636b67726f756e64576f726b436f6e74726f6c6c6572427567466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e427567466978466f7241744d656e74696f6e734d6f6e69746f72696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e427567466978466f7250686f746f41637469766974794c6f6767696e6752656d6f76616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e436f6e746163744361726456324f766572666c6f774d656e7573506861736532222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e46696e6450656f706c655573616765456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e497350656f706c655365617263684578656375746f72456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e506378417072696c323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784665627275617279323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784a616e75617279323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784a756e65323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784d61726368323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e557365506378436f6e74616374496e666f4c697374222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378417072696c323031374275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6d6d6f6e436f6d70617265427567466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6e746163744361726444706941776172656e6573734275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6e7461637443617264466f6e74486569676874444450494275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784a756e65323031374275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784d61726368323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784f63746f626572323031364275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e436f6e7461637453656172636849676e6f72657353796d626f6c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e50637848616e646c65734175746f446973636f766572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e526563697069656e744175746f436f6d706c657465537570706f7274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50726f6f66696e672e4175746f4d616e616765722e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e536d6172744c696e6b732e416c6c6f775265636f676e697a65536d6172744c696e6b73496e7369646550617261677261706873222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e54686573617572757350616e652e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5472616e736c61746f722e456e61626c65466c6f6f6467617465537572766579222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5472616e736c61746f722e466c6f6f646761746553757276657944656c6179222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e46574153686f756c64426c6f636b53656c4368616e67656446616c73654576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e57726974696e67417373697374616e63654372697469717565466f724347415049222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e57726974696e67417373697374616e636555492e50616e652e46697857726f6e67436c6f73654c6f676963222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e436f6c6f72466f6e74537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e46696c6556657273696f6e696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e48696464656e466f6e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e4f4172745465787456616c696461746552616e6765564544222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e416c6c6f774475706c696361746555696d557064617465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e436f7079506173746548544d4c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e5472616e7363726962652e436f6e666967436865636b44697361626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e417269614d617854656172646f776e55706c6f616454696d65496e536563222c20225622203a2022696e7433325f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e566f6c756d65547261636b696e674d61784576656e7473222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4169725370616365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224261636b656e645c22203a207b205c224576656e74735c22203a207b205c224c61796572486f7374496e697469616c697a6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706f7369746f7253657373696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2257696e33325c22203a207b205c225375624e616d657370616365735c22203a207b205c224c65676163795c22203a207b205c224576656e74735c22203a207b205c22416e696d6174696f6e50657263656e74556e64657233304650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416e696d6174696f6e4176674650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726f737357696e54496d654f6646697273744672616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224176657261676550726573656e74735065725365636f6e645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4368617274696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436861727445326f4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436861727445326f536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617274696e67456e644c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e436c69636b546f52756e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225850445c22203a207b205c225375624e616d657370616365735c22203a207b205c2254656c656d657472795c22203a207b205c224576656e74735c22203a207b205c2253616d706c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253616d706c6564325c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c225570646174655461736b557064617465646574656374696f6e325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465636c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22 OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.8 = 205c22446f63756d656e744368617452746342726f6164636173746572446973636f6e6e656374696e674576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e745374617465496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e74537461746552657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f6164636173746572526562726f61646361737450657273697374656e7453746174655265747279496e6e65724c6f6f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f61646361737465725265667265736850657273697374656e7453746174654173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746172745265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e744368617452746342726f616463617374657253746f705265616c74696d65436f6e6e656374696f6e4c697374656e696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c22536861726564436f6d6d656e74735f447261667443617264556e6d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224544502a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e44796e616d696343616e766173222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224f7574537061636543616e7661735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2250726f677265737355695c22203a207b205c224576656e74735c22203a207b205c22556e6578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578706f727461626c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2243616e7661735c22203a207b205c225375624e616d657370616365735c22203a207b205c225765624469616c6f675c22203a207b205c225375624e616d657370616365735c22203a207b205c2242726f777365724576656e7448616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4c6f616465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224e617669676174696f6e48616e646c65725c22203a207b205c224576656e74735c22203a207b205c224f6e4e61766967617465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e457863656c222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f617574685c22203a207b205c224576656e74735c22203a207b205c224f70656e46696c655c22203a207b205c224576656e74466c61675c22203a203330393632323437343338323231303536207d2c205c22457865637574654d65726765496e7374616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224b69636b4f6666517569636b536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22586c53796e6353746174654368616e67654c697374656e65724f6e53796e6353746174654368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f63734765744f70496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f7365576f726b626f6f6b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224261636b67726f756e6451756575655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e4765745265766973696f6e526573706f6e736552656365697665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f70464275696c644765745265766973696f6e526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f637350756c6c4f704f6e436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b5061636b61676546696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746172745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b456e637279707465644d6574726f46696c6553746f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536b697070656443686743656c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243717532674872446f456e74657243656c6c466d6c61584c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203330393632323437343338323231303536207d207d207d2c205c22496e6672615c22203a207b205c224576656e74735c22203a207b205c224164644c6f63616c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6d6d616e645c22203a207b205c224576656e74735c22203a207b205c2252656672657368416c6c5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22526566457874446174615c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2243616c635c22203a207b205c224576656e74735c22203a207b205c224669784d616e75616c43616c634f6e4c6f61645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4578706572696d656e746174696f6e222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224564676546657463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164696e67466972737453657373696f6e43616368655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744665617475726573466f72534458556e65787065637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224142436f6e66696754726561746d656e7454797065556e65787065637465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e457874656e736962696c697479222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224f66666963654a735c22203a207b205c224576656e74735c22203a207b205c22417070436f6d6d616e64446566696e6974696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225363726970744c6f6164585c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436174616c6f675c22203a207b205c224576656e74735c22203a207b205c2245786368616e67654765744c617374557064617465325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22547279446973636f76657245777355726c735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e67654765744c6173745570646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254727948616e646c6541757468656e7469636174696f6e526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245786368616e6765476574456e7469746c656d656e74735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786368616e67654765744d616e6966657374735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786368616e676552656672657368457874656e73696f6e4c6973745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241757468656e7469636174696f6e526963684170695c22203a207b205c224576656e74735c22203a207b205c22476574416363657373546f6b656e56324261636b67726f756e645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574416363657373546f6b656e56324d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574416363657373546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22496e7374616c6c65725c22203a207b205c225375624e616d657370616365735c22203a207b205c225461736b456e67696e655c22203a207b205c224576656e74735c22203a207b205c224765744368616e676564536f6c7574696f6e735461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224765744368616e676564536f6c7574696f6e735461736b5265676973746572536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b52656769737465724e65757472616c5061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b5363686564756c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b526567697374726174696f6e4572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b537563636573735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b496e46696e616c697a655374617465457863657074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b536574496e7374616c6c5374617475734572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b61676541707078457874726163746f725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b6167655265717565737465725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b6167655265717565737465725461736b53657276696365526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b446573747275637465644265666f7265436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b436f6d706c6574656446657463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b496e7374616c6c6564417070735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457870466972737453657373696f6e5461736b4170704665746368446f6e655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b61676553617665725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578705061636b616765526567697374726174696f6e496e666f5461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225061636b616765536f6c7574696f6e49445570646174655461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578747261637446696c6573546573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245787472616374466f6f747072696e7446696c6573546573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b52756e4e657874457863657074696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f73664d616e696665737456616c696461746f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744368616e676564536f6c7574696f6e735461736b52656769737465724c6f63616c655061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c476574436f6e66696755726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253636176656e6765725461736b436c656172526567697374726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b5265676973746572536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b52656769737465724e65757472616c5061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436865636b416e64557064617465416c6c536478536f6c7574696f6e735461736b52656769737465724c6f63616c655061636b6167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b4c6f63616c65556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744368616e676564536f6c7574696f6e735461736b5061636b616765556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c536478536f6c7574696f6e5461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253636176656e6765725461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253636176656e6765725461736b436c656172526567697374726174696f6e4661696c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d61696e5c22203a207b205c224576656e74735c22203a207b205c225344584261636b67726f756e645461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c65725374617274436f6d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c657253746172744e6f74434f4d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f7366496e7374616c6c657253746172744d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c5363686564756c655461736b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243496e7374616c6c65724d61696e5368656c6c53687574646f776e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744e6574776f726b436f737454696d656f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744e6574776f726b436f737453657276696365556e617661696c61626c655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c225061636b61676541707078457874726163746f725461736b5061636b616765496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253616e64626f785c22203a207b205c224576656e74735c22203a207b205c22506f73744f7366436f6e74726f6c4d6573736167655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f445041637469766174696f6e48616e67696e675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253616e64626f784372656174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 21 Sep 2026 13:58:14 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|9" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|11" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.12 = 496e666f506f6c6963794d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f4c6162656c416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744175646974496e666f46696c65416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6162656c696e67457870657269656e63655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224164644c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656d6f76654c6162656c4f627365727665725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6163726f5c22203a207b205c224576656e74735c22203a207b205c22426c6f636b4d6163726f46726f6d496e7465726e6574506f6c69637953657474696e675c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22426c6f636b6564657874656e73696f6e735c22203a207b205c224576656e74735c22203a207b205c2246696c65457874656e73696f6e4c69737446726f6d536572766963655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22536563757265526561646572486f73745c22203a207b205c224576656e74735c22203a207b205c224f70656e496e4f53525c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54617267657465644d6573736167696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c224275736261725468656d6553656c656374696f6e5374617475735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54656c656d65747279222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436c69656e7453616d706c696e674f76657272696464656e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253797374656d4865616c74684d657461646174614e6574776f726b436f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224576656e7451756172616e74696e65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164586d6c52756c65735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737349646c6551756575654a6f625c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22466c7573684576656e744275666665725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2254656c656d6574727953656e74696e656c56616c75655c22203a207b205c224576656e74466c61675c22203a2030207d207d2c205c224c6f636b65645c22203a2066616c7365207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54656c6c4d65222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2254656c6c4d655741435c22203a207b205c224576656e74735c22203a207b205c225175657279526573706f6e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e54657874222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225265736f75726365436c69656e745c22203a207b205c224576656e74735c22203a207b205c22446573657269616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656164466f6e74456c656d656e74735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2250757267654d756c7469706c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561645265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2257726974655265736f757263654d657461446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22474449417373697374616e745c22203a207b205c224576656e74735c22203a207b205c225265676973746572436c6f7564466f6e7443616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2248616e646c6543616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22466f6e744d616e6167657244657374727563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464436c6f7564466f6e745265736f757263655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466f6e74537562737469747574696f6e5c22203a207b205c224576656e74735c22203a207b205c22436f6c6c656374466f6e74537562737469747574696f6e55736167655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5472616e736c61746f72222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22416c7465726e6174655472616e736c6174696f6e735265747269657665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6e7465787475616c53756767657374696f6e734c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745465787453656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c61746564466565646261636b547269676765725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c6174696f6e43616e63656c6c65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745472616e736c6174696f6e53756767657374696f6e436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578636c756465644c616e677561676541646465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224578636c756465644c616e677561676552656d6f7665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d6963726f666565646261636b566f746553656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6f786d6c5472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657474696e6773436c6f7365645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657474696e67734f70656e65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365446f63756d656e744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365546172676574537761707065645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536f75726365546578744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546172676574446f63756d656e744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546172676574546578744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546578745472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e496e7365727465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e4c616e6775616765734c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e5461624368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e4578616d706c655265747269657665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e436f706965645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464496e4c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5558222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22526962626f6e585c22203a207b205c224576656e74735c22203a207b205c225265707572706f736564436f6d6d616e6445786563757465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225344585c22203a207b205c225375624e616d657370616365735c22203a207b205c224d65436f6e74726f6c5c22203a207b205c224576656e74735c22203a207b205c22547261636b65645363656e6172696f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225465616368696e6743616c6c6f75745c22203a207b205c224576656e74735c22203a207b205c225465616368696e6743616c6c6f7574416c726561647953686f776e4d617854696d65735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574416c726561647953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574546f6f4d616e7953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2244796e616d69634470695c22203a207b205c224576656e74735c22203a207b205c22446973706c6179546f706f6c6f6779456e756d65726174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446973706c6179546f706f6c6f67794368616e6765645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22446f63756d656e745265636f766572795c22203a207b205c224576656e74735c22203a207b205c22496e76616c696461746550616e65735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22546f6f6c746970735c22203a207b205c224576656e74735c22203a207b205c2253686f77546f6f6c7469705c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416e63686f7252656769737472795c22203a207b205c224576656e74735c22203a207b205c224765744f72437265617465416e63686f7252656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22526962626f6e546162735c22203a207b205c224576656e74735c22203a207b205c22526962626f6e5461624163746976617465645f466c6f6f64676174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c22436f6c6f725069636b65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d696e67536f6f6e54435348574e445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f46696c65457874656e73696f6e49636f6e4d617070696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e576f7264222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224544505c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e744964656e746974794368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f6f66696e675c22203a207b205c224576656e74735c22203a207b205c2250726f6f66696e674e6f50726f6f66526567696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225453706c4c6f61644c6962726172795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f75645370656c6c6572436865636b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f50726f6f6652756e4469666665727346726f6d5061726150726f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c617373696669636174696f6e4372697469717565526573706f6e7365506572664d61704578636565645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224772616d6d6172436865636b657243616c6c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22536176655c22203a207b205c224576656e74735c22203a207b205c22436d64446f53617665446f63436f7265436f6d6d616e64416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436d64446f53617665446f63436f7265416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464d617953746172745472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224669726553746174654f664175746f536176654f6e436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456964456e737572654f70656e466f72536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2242475361766546616c6c6261636b546f46475c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e646f466369466f72536176654361556e646f436f72655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72645c22203a207b205c225375624e616d657370616365735c22203a207b205c22426f6f745c22203a207b205c225375624e616d657370616365735c22203a207b205c2254696d696e675c22203a207b205c224576656e74735c22203a207b205c22446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22426f6f745c22203a207b205c224576656e74735c22203a207b205c22416464696e4d6f6e69746f7256616c6964617465426f6f745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e44697361626c65644469616c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e4d6f6e69746f7256616c6964617465426f6f74325c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c654f70656e5c22203a207b205c224576656e74735c22203a207b205c22464e4d45696453657446726f6d5873747a46747970466e6d4469725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e697469616c697a6542696e6172794261636b696e6753746f72654361636865735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72644d61696c5c22203a207b205c224576656e74735c22203a207b205c2248724c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872536176655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f6354696c696e675c22203a207b205c224576656e74735c22203a207b205c2254696c696e6749646c6542756e646c654576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654669726542756e646c65644576656e74735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577476574456e756d657261746f724576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577446973636f6e6e6563745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b52656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b556e72656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f417574686f72696e675c22203a207b205c224576656e74735c22203a207b205c224f6373446f776e6c6f6164526566557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244796e616d696353617665496e697469616c496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70436f6d706c657465645374617475735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2254687265655761794d657267655c22203a207b205c224576656e74735c22203a207b205c22435254435265766572745265706c61794b706f7353636f70654475726174696f6e5c22203a OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|2" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.6 = 224576656e74466c61675c22203a2032207d2c205c224275734261724f70656e4c6f63616c56657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434163746976697469657341676772656761746f72496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434163746976697469657341676772656761746f7252657475726e4572726f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243437369446f63756d656e74537461746545787465726e616c556e7265676973746572446f63756d656e744c697374656e65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243486973746f727941637469766974696573466163746f727952656672657368416674657252656e616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f62616c744163746976697469657346696c6556657273696f6e4c697374557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243536f61704461746150726f7669646572496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436f707956657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765436f707956657273696f6e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f7279506167654372656174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616765526573746f726556657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f72795061676553656c65637456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486973746f727950616e654e6f6e436c69636b61626c654974656d53656c65637465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f63616c41637469766974696573426567696e526566726573685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6666696365436f6c6c61624163746976697479436f6d6d616e644d534f446f63756d656e7450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e74436865636b4f757446696c65546f4c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c65486964655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f67676c6553686f775c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225759574143616c6c6f757453686f7743616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e41637469766974794765744c6173745669657754696d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747946696e6443757272656e74557365724c6f67696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7365656e416374697669747943616c6c6f7574436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253686f77536d616c6c53637265656e435759574143616c6c6f75745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253686172696e6755495c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f6c6c616250616e65557365725c22203a207b205c224576656e74735c22203a207b205c22536861726550616e65436f6d706c657465446973706c61795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253686172654469616c6f675c22203a207b205c224576656e74735c22203a207b205c224e61766967617465546f5765624469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e6441734174746163686d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c224544505c22203a207b205c224576656e74735c22203a207b205c22506f6c6963794d657461646174615c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c225369746573536572766963654170695c22203a207b205c224576656e74735c22203a207b205c22526571756573744173796e635c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265616446726f6d43616368655c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c224f666669636553706163655c22203a207b205c225375624e616d657370616365735c22203a207b205c224465736b746f704261636b73746167654e617669676174696f6e5c22203a207b205c224576656e74735c22203a207b205c2252656164446f634c6962466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526561644d696772617465644f4443466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c617a794c6f616446696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224c6f616446726f6d46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665496e746f46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2252656164546869735043526f6f745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22526561644c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265616453697465526f6f74427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744974656d57656244617655726c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2247657452656d6f74654974656d496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d2c205c22536861726564436f6d6d656e74735c22203a207b205c224576656e74735c22203a207b205c22436f6d6d6974436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744e61746976655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22447261667453746174654d616e61676572456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f737444726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465506f7374416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245324550657266547261636b65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224472616674436172644d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244726166744361726452656e64657265645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d61726b436f6d6d656e744372656174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656f70656e546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265736f6c7665546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536d6172745265706c79506f737465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224162616e646f6e44726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d6d656e74436f6e746578744368616e676564416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164436f6d6d656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436c6f7365566965774576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6e74657874437265617465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684f70656e566965774576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368566965774368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368426567696e44726166744576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684361706162696c69746965734368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6d6d656e74734368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6d6d656e7453656c65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368437265617465436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368446f634368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368456e64436f6d6d656e7453657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368456e6444726166744576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368466f63757350616e655472696767657265644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e6974436f6d6d656e7453657373696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e697469616c52656e646572436f6d706c657465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e76616c69644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684c6f6164546872656164735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e654368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e65466f63757353746174654368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e65546f52656e6465724576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636853656c656374436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636853657448616c6650616e65446973706c61794d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463685468656d654368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636844656c657465436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c656172436f6d6d656e7453656c656374696f6e416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f6c6c61625c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f725c22203a207b205c225375624e616d657370616365735c22203a207b205c22436f617574686f72446f63756d656e7448656c7065725c22203a207b205c224576656e74735c22203a207b205c22547269676765725265747269657665446f63756d656e74436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665456469746f72735461626c654d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265747269657665527463557365725c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d207d207d2c205c2241744d656e74696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446f63756d656e744163746976697479496e746567726174696f6e5c22203a207b205c224576656e74735c22203a207b205c224164645265636f7665726564416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737341744d656e74696f6e4e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6d6d656e74734e6f74696669636174696f6e436f6c6c6563746f7252656d6f766564436f6d6d656e74735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f63657373436f6d6d656e74734e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22536176654c6f67466f725265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437265617465446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c657465436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446973636172644c6f63616c416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574655265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243726561746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c65746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224372656174654d6f6465726e41744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e4c6f6746726f6d5265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e5265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225064616c6d446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456e73757265446f63756d656e744163746976697479436170747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e737572654c6f67507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d6574726f4f70656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f466f72417574686f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437265617465556e69717565417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f46726f6d417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224973436c6f7564446f63756d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365745361766564507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655265766973696f6e53657441637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6d6d656e74436f6e74656e744964656e7469666965725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f67436f6d6d656e744174747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472794372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536176654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657453617665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224162616e646f6e4c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b4372656174696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561737369676e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656f70656e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706c6574655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f70 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|10" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C7B5A78B-B840-4E82-89C9-3B7CAB4322DF}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|4" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|8" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|12" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t|1790316749" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId = "00188019C7988092" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile\MsaDevice = "t=GwD2AbuEBAAUuXgePZcYxdw8EZuBoUxTAR3gtGcOZgAAEMCwimns2iQ67ascDxDG4lrAAc/1sabJX4hUawmwW246cSXM25VN1T4a7U2YIzqST5MOUTlY9wrbHONROTHMpgvuLBRI3QNPxg9gbcrVPHgAl8AntxIxirb153uGsKTCkd1+Msx3Ytf6sT+2PwXfymes0/E90fZAKgkNm00xeqvIuc1vMBZwmmoL47rBjhfdE/07Qx/r+W0/PdGJUekrawR4S80unzVUPd5yMTEJqb16WlNynBWG7RE+kN2qqgzJc07hgqXUWXpyfsHuvQfnBQPvoci6uKVb+sGjBOiwZDUjbP2SF6ReL+AkouJIc/ZS1Ejep3s8C3yZoN77JKCvR7KZCe7egaNg+nIWcdDsV3d5J3UYHdtP8MhZeRKXTUBSMpWISWGTq0728dJQgtXI+tI1YgYJbEe/LE6G9o0j9XTJlFjsvYznZCIQnVdKgPDYkVtbcVIhtWVQ4wyqR9lNZqRVlCCl9uQ1OT6jz+EUhJKtHrbzKKLJOlTKhNSqEnQmQYriq0toK3s6glSxFzgrn1bfpdi7DDhx4bYCfFhZpQAKjAABOwCcO0ZrOCRICByfs5Otg+aTHJNM6QaQ/o0cQc5nKlfF5CEGpmycxbvWRqwO6iH4AQ==&p=" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|7" OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.9 = 2244656c6574654f7366436f6e74726f6c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225365744f4d546f6b656e4f6e54726964656e74486f73745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657454726964656e74486f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f445053686f775461736b70616e65436f6e74726f6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174654f7366436f6e74726f6c56325c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2243726561746552656d6f7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446f776e6c6f61644d616e69666573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656c6f6164416c6c4f7366436f6e74726f6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265737461727452656d6f7465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265737461727453616e64626f7865735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253746172744f7366436f6e74726f6c5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22417070436f6d6d616e64735c22203a207b205c224576656e74735c22203a207b205c22526962626f6e5847656e657261746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22417070436d6450726f6a656374696f6e5374617475735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224361636865446573657269616c697a6546726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22436163686553657269616c697a65546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224361636865536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22457773526566726573685c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2245786563757465416374696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246616c6c6261636b546f46697273744c6976654964496e4f454d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246616c6c6261636b546f46697273744c6976654964496e526962626f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2246657463684361636865536f6c7574696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e7374616c6c4d616e696665737452656164795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61644d696e43616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224d69734d61746368696e67526962626f6e4964656e74697479496e666f5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225072657061726553686f775461736b70616e6556325c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2252656d6f766546726f6d526962626f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f775465616368696e6743616c6c6f75745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225461736b70616e65417070436d64496e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2255585c22203a207b205c224576656e74735c22203a207b205c224c61756e63684f6d657853534f436f6e73656e744469616c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416761766555784d696e6f72426c6f636b65645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241707044656c6574656446726f6d446f63756d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f67436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f674f70656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f77496e666f626172436f6e73656e74566965775c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f774c6f6164696e6753746174655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f775265616374566965775c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22416464696e50726566657463685c22203a207b205c224576656e74735c22203a207b205c22507265666574636849636f6e735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225072656c6f61644d616e69666573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253616e64626f78507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241637469766174696f6e5c22203a207b205c224576656e74735c22203a207b205c224352656d6f74657250726f78795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253696e676c655369676e4f6e5c22203a207b205c224576656e74735c22203a207b205c22446973706c617953534f436f6e73656e7450616765466f7241706943616c6c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224578656375746547657453534f546f6b656e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d2c205c224576656e74735c22203a207b205c224f445041637469766174696f6e466f7254616761353572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f4450417070436f6d6d616e64735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434f4d416464696e4f7065726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f4450417070436f6d6d616e647343616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450417070436f6d6d616e6473496e7374616c6c54696d655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450417070436f6d6d616e6473526962626f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224557534c69626c657443616c6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67436865636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67446f63756d656e744f70656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67446f63756d656e7453686f77547275737455495c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e675472757374526573756c745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224577734c6173745570646174655374617475734974656d436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224577734c6173745570646174655374617475734974656d53686f776e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247656e314163746976697479416767726567617465644261736553756272756c655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247656e314163746976697479416767726567617465644661696c757265436f756e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247656e3141637469766974794167677265676174656453756363657373436f756e74576974685461675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f44504170704d616e6167656d656e744d656e755c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450496e73657274696f6e4469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f445050617273654e65774d616e69666573744572726f725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f44505265636f6d6d656e64656447616c6c657279436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450526962626f6e427269646765526962626f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f445053616e64626f7841637469766174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f45504d616e696665737450617273696e675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526962626f6e427574746f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253746f7265557365725374617475735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253746f7265557365725374617475734572726f725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f445041637469766174696f6e466f7254616761353572715c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f44504c6174656e63795c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e466565646261636b222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c2253617665526573706f6e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e46696c65494f222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224d534f5c22203a207b205c224576656e74735c22203a207b205c22517569636b41636365737350696e4f72556e70696e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f4f4c446f634e657744657374727563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f63616c446f63756d656e74496e666f557073656c6c4576656e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f63616c446f63756d656e74496e666f466c796f757444726f707065645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2248616e646c65417574684661696c7572655f5573654578697374696e6743726564735f47656e657269634661696c7572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f4f4c446f6342617365476574504b4d436c69656e7445785c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f536572766572496e666f476574536572766572496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745265636f766572794872476574447270436f72655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745265636f766572794d736f4872426567696e4d6f646966794472705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225469746c654261725361766555694d616e616765725772697465537461747573546f5469746c654261725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164437369446c6c466f72436c69636b3252756e456e7669726f6e6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2249735365727665724361636865645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d616e75616c5361766555736167655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224353495c22203a207b205c224576656e74735c22203a207b205c225265717565737441646170746572556e657870656374656443616c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416d49416c6f6e6550726f63657373526573706f6e73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e73616374656453747265616d446174615570646174655472616e73616374696f6e436f6d6d69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e73616374656453747265616d446174614d657267655472616e73616374696f6e436f6d6d69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224343616368656446696c655363686564756c6546696c6555706c6f6164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243656c6c53746f726167654f6e426c6f624865617052657175657374526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243656c6c53746f726167654f6e426c6f624865617052657175657374526573756c74434d555c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e49734f6e6c79436c69656e7452657175657374436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437369446176436c69656e7453656e64526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574446f63756d656e7446726f6d55726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224343616368656446696c654373694c6f616446696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224343616368656446696c654373695361766546696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f63756d656e74466163746f72794372656174654e6577446f63756d656e745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f63756d656e7452656e616d655375626d6974576f726b4974656d5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22464d617050617468735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22476574536861726555726c466f72436f6e7461696e65724173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22476574536861726555726c466f7246696c654173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22476574576f706955726c46726f6d46696c654964656e7469666965724173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2249446f63756d656e7447657456657273696f6e4c6973745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2249446f63756d656e74526573746f72654173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224973446f776e6c6f616465644261736556616c69644e6f48617368436865636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253796e634261636b65645265636f6e63696c65725472795265636f6e63696c65546f4c6174657374416674657256657273696f6e4e6f74466f756e645c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253796e634261636b65645265636f6e63696c65725472616e736974696f6e4f6e6c696e655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2254727944657374726f794f666669636546696c6543616368655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22576f706942726f77736542726f777365546f436f6e7461696e65724173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d207d2c205c225375624e616d657370616365735c22203a207b205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c2243616368654f70746963735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f7074696373446f776e6c6f61644572726f72446973747269627574696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f7074696373446f776e6c6f61644572726f72446973747269627574696f6e7337446179735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f70746963734572726f72735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f707469637346696c6553746f726546696c6553697a65446973747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f707469637355706c6f61644572726f72446973747269627574696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f707469637355706c6f61644572726f72446973747269627574696f6e7337446179735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f7074696373576f726b696e67436f707946696c6553697a65446973747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656d6f766546696c65456e7472795c22203a207b205c224576656e74466c61675c22203a OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.10 = 2032207d2c205c2243616368654f707469637350657246696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253746172744f666669636546696c6543616368655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d2c205c225375624e616d657370616365735c22203a207b205c2243656e7472616c5461626c655c22203a207b205c224576656e74735c22203a207b205c22436865636b536368656d6156657273696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436c65617243616368655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22437265617465446174616261736546696c655573696e6754656d706c6174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2243726561746544617461536f757263654661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2244617461736f757263654f70656e4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246696c65436163686550726f70657274696573526f774e6f74466f756e645c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d69677261746546696c654e616d6546726f6d496e695c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22526f77736574556e6b6e6f776e4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536368656d61557067726164655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224661756c744d616e6167656d656e745c22203a207b205c224576656e74735c22203a207b205c224661756c745265636f766572795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224661756c745265706f72745c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d2c205c2250726f746f636f6c5061727365725c22203a207b205c224576656e74735c22203a207b205c2250617273655572695c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b55726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496672496e697441726773576f72645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248724c61756e636855726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464c6f6164436d644c696e65436f72655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f746f636f6c48616e646c65725c22203a207b205c224576656e74735c22203a207b205c225472794f70656e696e674c6f7248797065724c696e6b496e4e6174697665436c69656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f746f636f6c48616e646c65724d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e7061636b4c696e6b5c22203a207b205c224576656e74735c22203a207b205c22556e7061636b4c696e6b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b4c696e6b4173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b4c696e6b5769746848696e745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225254435c22203a207b205c224576656e74735c22203a207b205c2246696e6453657373696f6e456e64706f696e7452756e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e74536861726555726c5c22203a207b205c224576656e74735c22203a207b205c22556e7061636b536861726555726c416e6448616e646c65526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e556e7061636b55726c436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486c696e6b5c22203a207b205c224576656e74735c22203a207b205c224d736f4872486c696e6b43726561746546726f6d537472696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c6553746f72655c22203a207b205c224576656e74735c22203a207b205c22465344436f7272757074696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2247617262616765436f6c6c656374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225a65726f4279746546696c6555706c6f6164417474656d707465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2252756e74696d6550726f706572746965735c22203a207b205c224576656e74735c22203a207b205c22496e636f6d70617469626c6543736956657273696f6e44657465637465645c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224f66666963655c22203a207b205c225375624e616d657370616365735c22203a207b205c2246696c65494f5c22203a207b205c225375624e616d657370616365735c22203a207b205c224353495c22203a207b205c225375624e616d657370616365735c22203a207b205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c2243616368654f707469637356325c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d2c205c224d6f6373695c22203a207b205c224576656e74735c22203a207b205c22557064617465486f73745469705c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e46696c6553797374656d222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c2246696c655c22203a207b205c224576656e74735c22203a207b205c225265706c61636546696c654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e466f726d73222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22466f726d73536572766963655c22203a207b205c225375624e616d657370616365735c22203a207b205c2241637469766974795c22203a207b205c225375624e616d657370616365735c22203a207b205c22486976654461746150726f76696465725c22203a207b205c224576656e74735c22203a207b205c22476574526573706f6e7365436f756e74427946696c7465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2243444250726f76696465725c22203a207b205c224576656e74735c22203a207b205c22476574526573706f6e7365436f756e74427946696c7465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4772617068696373222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22415243457863657074696f6e53636f70655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2245326f5669657752656e646572506572666f726d616e636541637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224172745669657756616c69646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f6669745368617065546f54657874436d645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546f704c6576656c456666656374447261775c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174654269746d617046726f6d506c6174666f726d4269746d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e6b496e70757453757266616365426173655570646174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250617468576964656e657246576964656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250617468576964656e657246576964656e53696d706c65506174685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224776697a536d61727441727450726f7065727469657354656c656d657472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746544657669636544334431305c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22537065637472655472616e73636f646541637469766974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e73657274496e646976696475616c4d6f64656c334441637469766974795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f61646564496d61676550726f706572746965735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22496e736572744d6f64656c334441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22537065637472654372656174655363656e6541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d6f64656c334452656e64657241637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4964656e74697479222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22456e7375726550726f7669646572496e697465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574506572736f6e50726f66696c6553657475705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224964656e74697479536e617073686f745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657450726f7669646572466f7241757468536368656d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472794964656e74697479506172656e744d617463685c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526f616d696e6750726f7879496e69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536861726564437265645265667265736846726f6d53746f72655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561644f6e6546726f6d43726564656e7469616c4c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22435265616453796e635461736b52756e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f6d61696e4a6f696e65644f72436c6f7564446f6d61696e4a6f696e656453657373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765744164616c416363657373546f6b656e46726f6d4372656450726f76696465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6e666967546f6b656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574426c6f636b696e67536572766963655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f70756c617465536572766963654d61705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657441757468656e74696361746564536572766963655469636b65745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526566726573684964656e7469746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224765745365727669636555726c466f7246656465726174696f6e50726f7669646572416e616c797369735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365727669636555726c5374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637175697265536572766963655469636b6574466f724144414c5c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2253697465735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e496e736967687473222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74735c22203a207b205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436163686546696c654e6f7456616c69645c22203a207b205c224576656e74466c61675c22203a20323536207d207d2c205c225375624e616d657370616365735c22203a207b205c224f66666963655c22203a207b205c224576656e74735c22203a207b205c2253797374656d616c69645c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22496e7369676874735c22203a207b205c224576656e74735c22203a207b205c22496e73696768747350616e655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e73696768747350616e65725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253797374656d5c22203a207b205c224576656e74735c22203a207b205c224163746976697479715c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224163746976697479735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22536d6172744c6f6f6b75705c22203a207b205c224576656e74735c22203a207b205c22415c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f7079466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331305c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331315c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657446656174757265476174657331355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573325c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573335c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573345c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573355c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573365c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573375c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573385c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574466561747572654761746573395c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248746d6c5072656665746368526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225265667265736843616368656446696c65735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446f776e6c6f61645265736f757263655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2241757468656e7469636174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526573756c7447726f7570546f52656e6465725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253656e64576562536f636b6574526571756573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22576562536f636b657450696e67506f6e674c6174656e63795c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446961676e6f737469635c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2238564d65686c6c OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\LockFile WindowsUpdateService.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\LockFile\ = "Encrypted File" WindowsUpdateService.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.lock WindowsUpdateService.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.lock\ = "LockFile" WindowsUpdateService.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.lock\OpenWithProgids WindowsUpdateService.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.lock\OpenWithProgids\LockFile = "0" WindowsUpdateService.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings firefox.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4500 schtasks.exe 5644 schtasks.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4548 encryptor.exe 4548 encryptor.exe 3660 powershell.exe 3660 powershell.exe 5932 WindowsUpdateService.exe 5932 WindowsUpdateService.exe 5772 powershell.exe 5772 powershell.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4548 encryptor.exe Token: SeDebugPrivilege 3660 powershell.exe Token: SeIncBasePriorityPrivilege 5932 WindowsUpdateService.exe Token: SeDebugPrivilege 5772 powershell.exe Token: SeDebugPrivilege 2752 firefox.exe Token: SeDebugPrivilege 2752 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe - Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 5400 OfficeClickToRun.exe 3576 OfficeClickToRun.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe 2752 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1048 4548 encryptor.exe 89 PID 1048 wrote to memory of 4500 1048 cmd.exe 91 PID 4548 wrote to memory of 4316 4548 encryptor.exe 92 PID 4316 wrote to memory of 3008 4316 cmd.exe 95 PID 4548 wrote to memory of 644 4548 encryptor.exe 96 PID 644 wrote to memory of 5396 644 cmd.exe 98 PID 4548 wrote to memory of 2496 4548 encryptor.exe 99 PID 2496 wrote to memory of 756 2496 cmd.exe 101 PID 4548 wrote to memory of 5032 4548 encryptor.exe 102 PID 5032 wrote to memory of 5116 5032 cmd.exe 104 PID 4548 wrote to memory of 1208 4548 encryptor.exe 105 PID 1208 wrote to memory of 3464 1208 cmd.exe 107 PID 4548 wrote to memory of 5016 4548 encryptor.exe 108 PID 5016 wrote to memory of 4636 5016 cmd.exe 111 PID 4548 wrote to memory of 3660 4548 encryptor.exe 112 PID 5932 wrote to memory of 4656 5932 WindowsUpdateService.exe 115 PID 4656 wrote to memory of 5644 4656 cmd.exe 117 PID 5932 wrote to memory of 5640 5932 WindowsUpdateService.exe 118 PID 5640 wrote to memory of 2256 5640 cmd.exe 186 PID 5932 wrote to memory of 6052 5932 WindowsUpdateService.exe 122 PID 6052 wrote to memory of 2520 6052 cmd.exe 124 PID 5932 wrote to memory of 2508 5932 WindowsUpdateService.exe 125 PID 2508 wrote to memory of 3972 2508 cmd.exe 127 PID 5932 wrote to memory of 2696 5932 WindowsUpdateService.exe 128 PID 2696 wrote to memory of 4556 2696 cmd.exe 130 PID 5932 wrote to memory of 1776 5932 WindowsUpdateService.exe 131 PID 1776 wrote to memory of 5072 1776 cmd.exe 133 PID 5932 wrote to memory of 896 5932 WindowsUpdateService.exe 134 PID 896 wrote to memory of 2348 896 cmd.exe 136 PID 5932 wrote to memory of 5772 5932 WindowsUpdateService.exe 137 PID 5932 wrote to memory of 116 5932 WindowsUpdateService.exe 140 PID 116 wrote to memory of 312 116 cmd.exe 143 PID 224 wrote to memory of 2752 224 firefox.exe 144 PID 224 wrote to memory of 2752 224 firefox.exe 144 PID 5932 wrote to memory of 2492 5932 WindowsUpdateService.exe 145 PID 2492 wrote to memory of 2936 2492 cmd.exe 147 PID 5932 wrote to memory of 3776 5932 WindowsUpdateService.exe 148 PID 3776 wrote to memory of 2964 3776 cmd.exe 150 PID 5932 wrote to memory of 4808 5932 WindowsUpdateService.exe 151 PID 4808 wrote to memory of 1788 4808 cmd.exe 153 PID 5932 wrote to memory of 816 5932 WindowsUpdateService.exe 154 PID 2752 wrote to memory of 928 2752 firefox.exe 156 PID 2752 wrote to memory of 928 2752 firefox.exe 156 PID 2752 wrote to memory of 928 2752 firefox.exe 156 PID 816 wrote to memory of 2560 816 cmd.exe 157 PID 2752 wrote to memory of 3484 2752 firefox.exe 158 PID 2752 wrote to memory of 3484 2752 firefox.exe 158 PID 2752 wrote to memory of 3484 2752 firefox.exe 158 PID 2752 wrote to memory of 3484 2752 firefox.exe 158 PID 2752 wrote to memory of 4848 2752 firefox.exe 159 PID 2752 wrote to memory of 4848 2752 firefox.exe 159 PID 2752 wrote to memory of 4848 2752 firefox.exe 159 PID 2752 wrote to memory of 4848 2752 firefox.exe 159 PID 2752 wrote to memory of 3568 2752 firefox.exe 160 PID 2752 wrote to memory of 3568 2752 firefox.exe 160 PID 2752 wrote to memory of 3568 2752 firefox.exe 160 PID 2752 wrote to memory of 6044 2752 firefox.exe 161 PID 2752 wrote to memory of 6044 2752 firefox.exe 161 PID 2752 wrote to memory of 6044 2752 firefox.exe 161 PID 2752 wrote to memory of 6044 2752 firefox.exe 161 PID 2752 wrote to memory of 956 2752 firefox.exe 162 PID 2752 wrote to memory of 956 2752 firefox.exe 162 PID 2752 wrote to memory of 956 2752 firefox.exe 162 PID 2752 wrote to memory of 956 2752 firefox.exe 162 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\encryptor.exe"C:\Users\Admin\AppData\Local\Temp\encryptor.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\System32\cmd.execmd /c schtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\system32\schtasks.exeschtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:4500
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WinDefend >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\system32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:3008
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WdNisSvc >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\sc.exesc stop WdNisSvc3⤵
- Launches sc.exe
PID:5396
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop SecurityHealthService >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\system32\sc.exesc stop SecurityHealthService3⤵
- Launches sc.exe
PID:756
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop Sense >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\system32\sc.exesc stop Sense3⤵
- Launches sc.exe
PID:5116
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WdBoot >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\sc.exesc stop WdBoot3⤵
- Launches sc.exe
PID:3464
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WdFilter >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\system32\sc.exesc stop WdFilter3⤵
- Launches sc.exe
PID:4636
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockatFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -EnableControlledFolderAccess Disabled; Add-MpPreference -ExclusionProcess 'encryptor.exe','decryptor.exe'; Add-MpPreference -ExclusionPath 'C:\'; Add-MpPreference -ExclusionPath 'F:\'; "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5400
-
C:\Windows\Tasks\WindowsUpdateService.exe"C:\Windows\Tasks\WindowsUpdateService.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\System32\cmd.execmd /c schtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\system32\schtasks.exeschtasks /Create /TN "WindowsUpdateService" /TR "\"C:\Windows\Tasks\WindowsUpdateService.exe\"" /SC ONLOGON /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:5644
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WinDefend >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\system32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2256
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WdNisSvc >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\system32\sc.exesc stop WdNisSvc3⤵
- Launches sc.exe
PID:2520
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop SecurityHealthService >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\sc.exesc stop SecurityHealthService3⤵
- Launches sc.exe
PID:3972
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop Sense >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\sc.exesc stop Sense3⤵
- Launches sc.exe
PID:4556
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WdBoot >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\system32\sc.exesc stop WdBoot3⤵
- Launches sc.exe
PID:5072
-
-
-
C:\Windows\System32\cmd.execmd /c sc stop WdFilter >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\system32\sc.exesc stop WdFilter3⤵
- Launches sc.exe
PID:2348
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockatFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -EnableControlledFolderAccess Disabled; Add-MpPreference -ExclusionProcess 'encryptor.exe','decryptor.exe'; Add-MpPreference -ExclusionPath 'C:\'; Add-MpPreference -ExclusionPath 'F:\'; "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5772
-
-
C:\Windows\System32\cmd.execmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable3⤵PID:312
-
-
-
C:\Windows\System32\cmd.execmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable3⤵PID:2936
-
-
-
C:\Windows\System32\cmd.execmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable3⤵PID:2964
-
-
-
C:\Windows\System32\cmd.execmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable3⤵PID:1788
-
-
-
C:\Windows\System32\cmd.execmd /c schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Maintenance" /Disable >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Maintenance" /Disable3⤵PID:2560
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3576
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27099 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {f4598484-be62-4c49-a1cc-e3c8bd6fcc93} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27135 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {c1b044b1-12fc-4a81-9210-f1577bf1725f} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:3484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3404 -prefsLen 27325 -prefMapHandle 3408 -prefMapSize 270279 -jsInitHandle 3412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3596 -initialChannelId {312f002e-2367-4ddd-9eb6-c632a2cd5e54} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵PID:4848
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3796 -prefsLen 27325 -prefMapHandle 3800 -prefMapSize 270279 -ipcHandle 3816 -initialChannelId {14b70ae5-57d8-48da-89b7-bffd7b026d39} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:3568
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2668 -prefsLen 34824 -prefMapHandle 2580 -prefMapSize 270279 -jsInitHandle 2724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3096 -initialChannelId {f487ccc1-1d6b-4258-8d7a-d91c389d0147} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵PID:6044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3684 -prefsLen 34824 -prefMapHandle 2500 -prefMapSize 270279 -jsInitHandle 2488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4220 -initialChannelId {088d4419-cee0-4a80-9c58-fed20f79fb38} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab3⤵PID:956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4260 -prefsLen 34824 -prefMapHandle 4264 -prefMapSize 270279 -ipcHandle 4276 -initialChannelId {e8c399c9-65fc-4da6-ac98-b4e0a0c953d5} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility3⤵PID:4788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4320 -prefsLen 34931 -prefMapHandle 4324 -prefMapSize 270279 -jsInitHandle 4308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4388 -initialChannelId {1c710954-9acf-4039-bd24-c862c6fa29e2} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵PID:3544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4312 -prefsLen 34983 -prefMapHandle 2880 -prefMapSize 270279 -jsInitHandle 3336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3144 -initialChannelId {6a4c28b7-d01f-4f40-ab49-5d702940c223} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵PID:5792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4628 -prefsLen 34983 -prefMapHandle 4644 -prefMapSize 270279 -jsInitHandle 4616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4608 -initialChannelId {1f0511e3-a171-4267-b294-961145f17718} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵PID:3660
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4792 -prefsLen 34983 -prefMapHandle 4796 -prefMapSize 270279 -jsInitHandle 4800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4808 -initialChannelId {232bb820-1e33-431a-925a-d27c7a5b000a} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵PID:6088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4816 -prefsLen 35062 -prefMapHandle 4820 -prefMapSize 270279 -jsInitHandle 4844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4924 -initialChannelId {3ad80431-22f7-4a2e-b876-3a688849f7a9} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵PID:6856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2904 -prefsLen 32950 -prefMapHandle 3392 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4644 -initialChannelId {4eed9732-1437-4d4b-82c3-a0f7fe08be16} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵PID:7004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4876 -prefsLen 32950 -prefMapHandle 4860 -prefMapSize 270279 -jsInitHandle 3232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2760 -initialChannelId {adc4118a-abf0-451e-9166-b7af65683924} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵PID:6888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4528 -prefsLen 32950 -prefMapHandle 4536 -prefMapSize 270279 -jsInitHandle 4748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2868 -initialChannelId {ae3a4ee0-241f-46ae-88fd-0c1ed36cc200} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵PID:7076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32950 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {3a865673-ab07-4723-9095-7190c2b2694c} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵PID:4948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32950 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {23c8dffb-11b8-4a9e-9627-96071afffde9} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵PID:1944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32950 -prefMapHandle 5340 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {63f6a069-0943-4ad1-901a-d9890e3be91a} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵PID:1748
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2560 -prefsLen 32950 -prefMapHandle 4408 -prefMapSize 270279 -jsInitHandle 2624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4576 -initialChannelId {270c9e93-563f-4a3a-b9ea-ef9c88193767} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵PID:1188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4568 -prefsLen 32950 -prefMapHandle 4500 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5084 -initialChannelId {8e5ab57e-3e20-452f-8a00-6a1c34491cd2} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵PID:2096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32950 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {7940aaf4-eb1e-4779-bf02-7ad330ca2f7f} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵PID:4232
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2500 -prefsLen 32950 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2868 -initialChannelId {a15beef6-7c6c-4257-b623-e7894931c10a} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵PID:2256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 32950 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {2584017d-a158-4bcf-9a01-327071e36ede} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵PID:2184
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412 -prefsLen 32950 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {7ee417d3-71f5-400f-8ee1-85eb74f6c612} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵PID:6904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 35062 -prefMapHandle 4488 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {ee2b50e4-68de-4fe7-87af-f57dbaf93889} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵PID:6208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2976 -prefsLen 32950 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {155f6686-625f-4799-b8a9-518a74a9466f} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵PID:6508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4932 -prefsLen 32950 -prefMapHandle 4792 -prefMapSize 270279 -jsInitHandle 4784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5668 -initialChannelId {96e1d5ff-4a08-4c5b-a1ac-da6bf142d726} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵PID:6520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4604 -prefsLen 32950 -prefMapHandle 3708 -prefMapSize 270279 -jsInitHandle 2464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1348 -initialChannelId {448ece6d-c060-43fa-8152-81d9310ed55e} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵PID:6580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 32950 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {cd74a7dc-0f23-4df1-8b67-389fbbbb19d7} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵PID:6592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32950 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 4956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4444 -initialChannelId {29b54067-2410-41e3-a6da-561266766ff1} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵PID:6600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 32950 -prefMapHandle 4360 -prefMapSize 270279 -jsInitHandle 4572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {06b06181-03e9-409e-b748-c214ba9eda30} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵PID:6624
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3392 -prefsLen 32950 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 4968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {ec682061-9bc9-4f66-aae4-55a12c6d670e} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵PID:6628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 32950 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4848 -initialChannelId {97ebff1d-2c4a-4aa5-b523-7eac548b83d7} -parentPid 2752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵PID:5332
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:6088
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵PID:544
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3897055 /state1:0x41c64e6d1⤵PID:5584
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
4Disable or Modify Tools
3Indicator Removal
1File Deletion
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 4KB
- SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
- MD5 bdb25c22d14ec917e30faf353826c5de
- SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
- SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
- SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
- TLSH T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ad21287ab3ad94479292e269fac8a9688b02043d51b8efe681dd56a50a56815f
- MD5 390c815be538d5e2bea2d7a6c318f2b5
- SHA1 e3db0f6eb1909024eeb56f8c61677db55d9f3fe0
- SHA512 4ec38b9d107e23ee6c2dabf37e511fda352a714c82dafee0a37de33e188cdf1fc59da1ddf8fd3f806a1bf2af9853588a2a28afa71491bff01c17869422919521
- TLSH T13B218627F3DC8A21CC86163A109D9C1076B683C7809ECF9F6BC4D614A0BF998CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.contile.json
- Size 4KB
- SHA256 5f06b62f401f8201fed93b029d7d83e2d5e2cfc90fcc9d573a17c2dd37fa8f63
- MD5 47f7beb91b14bc6c88e30f66474b312d
- SHA1 4be90adb4c1f1373bd6145ca88dab3825c33c40f
- SHA512 9a04827ab1edb7e25994f2e29df79bfda1d6332f0f5f1438a96235bd3f350806fdaeb1bb1fb88593a403367b37f61a1aa8abca84f7b5f892961dd39a8ee3cac9
- SSDEEP 48:Yd0rqBreDZQpybKgSZ3bfoqGBDUoqWvFZo5reDZZybK3tL6VJQa1SxBkQ6nqXLo8:G7sBSZLGwSsegVJOxn6n9ysZQ+P1olz
- TLSH T14AA1D79F917C15171B24FBE52C5F168CB017312A8AD48CECB201DD22E269BF9719A888
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.discovery_stream.json
- Size 76KB
- SHA256 2f84154aefc128cbe8b52335258d4ecad444d2795de9954074fcad97f540a2a7
- MD5 9e50bc5d491c795dc87aa0772f8658c3
- SHA1 ea4adbd4cc7811462a8c4506c2b6650c44a55d3c
- SHA512 db196eb32727459a40a41b84e7e3b012c9c84fc5e0d61d1d2256eecb6a6a3b1b48eaef07928f47bfba7bbd7d90740ec628bca4f69bc67809005df538730de955
- SSDEEP 768:DyIiZtdeSvlNRkq8YWOLTqEoWNKbEkNi2i/LnhJ/3jbIGakB7:+IGiq9c1Ni2iDnzjbr
- TLSH T112730AA397EC71BB1BA427CB1C0F795B66E60185E34901CDECEEC92D8189685123F5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.weather_feed.json
- Size 14B
- SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
- MD5 3ea4da2ce03c4204ffe9b30074d62fac
- SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
- SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\1477F7CCD1FDCE9DFC8AAA1A94881E7787E576F4
- Size 13KB
- SHA256 c9cbf8e9d2b05bcbcb4f29265867e97eb9ef76b73127890b4af52ffc197f0922
- MD5 f1fecc64cba75c525e0f51bf04a97be6
- SHA1 931d0659756aa275624587cc939632656ffeafd3
- SHA512 fda4f5ad21d3d66adb60e57e46b48922e8338677ec1817eff35fe33ef9c81b9db4fe4d108a31c86db28eafd7c4608ef90ad92a0c1e4f7c5a8e76a991f575a4fd
- SSDEEP 384:R0AkiPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eLOct:CRiPmoEa/h4Y2sDIVy8Y
- TLSH T17F52A0F98B00944C459EE6E7D88C11B95C3DB713D2E970B66458320E9BEA37DD1B60C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\374B9B139673B5DDBE8D5AC8EE2C2175235CBE1A
- Size 366KB
- SHA256 52adc003d88390c867ef7f31de19846645e071451020447648bb490cede94840
- MD5 18c0bdc92aac985f1848f3f07642360e
- SHA1 7aea2fa454d38613509720dd9a0ea8c660e7007d
- SHA512 a036cad60b1227c64367209fd3a283b7265f6a13c5aae44ba1f60c66dec9fcf3bf41c8f6e88c9c0343a49afe687d401549f2989d5301f9133381ddb0dfab2556
- SSDEEP 6144:qZHssF/GKbrF/H0QDymDEMpAUZENFwfo4/1Vhn75vzh7CTp/WcBEYELW2+dWceEB:qZHxOq/H0QDySxSkCFwQ4/bhnZxKVBEm
- TLSH T1258423FDC0A134E70E16FB1ABC3D102BD80CD96CF62D5A9DFC851139699C5A6A7EC844
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\3FDF61F92F46CA2CDC7269B91F61F84C1EA2DDC8
- Size 25KB
- SHA256 26ed977cf46fe9e4f0b0dbd4b260f6d325c9879f238e7817033c4ec112dffb23
- MD5 c5adc262e12e83e95e4b91b5a7e19fc4
- SHA1 73b0021a736f93322fe15b746b4560f2aad65f4c
- SHA512 5effa0c07399358ce9ca18f9ba8250a64af298986b4e777a703ae42a32cb6eddff94ddfb34da0002e8096fb55bde3aacf5b6bb346bb9bf738a6d1b6aa8576347
- SSDEEP 768:oE2to4U/QagAHwY2IKWXPmoEa/h4Y2sDIVy8i:Y2DV527W/DWyR
- TLSH T165C2E0F9CB917504044DD5EAE8EC60791C3DA723C2EE746956803B1FD3CA3BCC5A6066
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\42D3E42A580EB17B3F1B94392AA9049B61B4FB48
- Size 11KB
- SHA256 8d6aeb6ab13da744f36e447bf8dc1680186a0842c1eb42a154e3e8508207ee87
- MD5 93f77840d70cbb457c2f5b92ee232ab9
- SHA1 7744009116c54f64e78eb75f2eda9fb7a4968f0f
- SHA512 d70a952d38df999ee048cf14a07fb34caede558b8b7bae04c350b61a6e6a68edcda747797d9e2c0632c6025318c8dccdc45d1e6e820be0eb965f2c3e874bfc0d
- SSDEEP 192:LG3y8FevwTUbtY1J+Nn9am3+j7VMirN2zsb0HjGPl2BadE4Pro15j75ywpskCLRq:IPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eLwh
- TLSH T198429EF98B00A94C4C9ED1E7D8CC11A51C2DAB57C79A74B96418320E9BDE3B9D1FA0C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\4F7F3B643F01931E0628C11F4D30E514780D17D9
- Size 18KB
- SHA256 9e6984539e6f40af55a2044580b97eedb22e12556b2d00f78b77e895482a0936
- MD5 a97a88b0039b5e479766e047e1838f6a
- SHA1 3c8f1f5ae243ced0599a77bfaac8456f5fd7e614
- SHA512 bf6e130134e3d47fdfccba1d44cee0457247b99231b3332b9af83e123773d34f7cee57681ae90e30a924516d76adc5ee20892978745066e2091453eb4d75bd5e
- SSDEEP 384:ETqtXYxDP595wiE+bsf8PmoJ+N9aRVnh2zY0DE2Ba/rIVy8eL1jd++:CF95Nvy8PmoEa/h4Y2sDIVy8OJh
- TLSH T1AF82BFF50F10A8184CAFD1D7D8CC15E96C3CE303D28A64B92804325E9AE77BC96F908B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\4FC1656D92341081D4DBBF1837BADD5D7393362C
- Size 1.4MB
- SHA256 7b8c37bb7b0bbdeb437bb54f2fbe9092cc9e16f15c933ebc16ebb434d774478b
- MD5 6ac7c96d658f8d6a477ffac8c584e6ce
- SHA1 c8ba68cedf5719c3c3872b6ac18cbf6773d98638
- SHA512 cc0ee6d7c515813831bdb8e57a782a095609879874aa3f2cf8411867cbb4b8053cba3fa951169a1d0101c079a9ca1ea3b13916263ee031213d950cac7b482335
- SSDEEP 24576:5UoAm9BjEPdCXKbRthTRC2AAAnfEdt+f9mGsLJK9YxDiK5xJ+VLCrB+7EEpojVSF:WnCpEAuhArAAcbSgXLJK9kiexJuYB+7n
- TLSH T19B6533D607C29FACC754FA83615F0E408C3AB76B76531368CA09F76783F99664B1C2A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\5479F6E8E6BCADEE1972E76D6C2E84D6C06843F9
- Size 84KB
- SHA256 d6f530d23b1c1bf6268e7ccd7c7478b8041158f1ec096e5d4d9abba7e6c2af66
- MD5 d77f6b96febf6b54fa55cbca13716e57
- SHA1 c2e1385ec09395108b6b824c20bbc7d2708fbc04
- SHA512 d887d6668377c17779dec02beae0aa89fcb88a80cfb4bbf4f0b8d9ec3af7341dc4a7e2337d87cf9f0c26eafb40137ad00337040823150ccabf95f894fa28929e
- SSDEEP 1536:d7SQKaZckocww+olQHuT3k2G8it9/cwHCuaegC1XeWvDWy3:JSaZBo9Vz63k75PiF8XeSKQ
- TLSH T1EF8312BA3A6079600942F9B0F9D850620C3D2317535A44BE61E53B49EEEE3B877F9C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
- Size 16KB
- SHA256 6665c6a29f99d654bdf88e9e00b0a462a339c33c91f7c8f7b68c4fec7a09ce9a
- MD5 b66e3e555107a6bef92d54df1796af2e
- SHA1 477bc5b6bdac21e228e0db9348fe297ae66bccb8
- SHA512 12472e2e25b756186ba111bb10293b604edb227c4398ff1ab7a90486ab4bd0b6a4b6f2454fd63aba7fdf8ba91423e3c832020d1e15500e2b42132e707f37c6d9
- SSDEEP 384:HkCjiO024YaWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA5:EzZYaWTToXJWTTogB7S/AmVAf+hRMo
- TLSH T158728D7D9F013CAD165780E8C8F583598D1CB6E7DFE5C06D22883E0DC988A6A70F944E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\5EC47CD516913FED2E8D5B4E8117823AA9E47465
- Size 15KB
- SHA256 77ae8e891e182c9247dfbb94293f41578941c15f4d722cf528e965dcf733b83d
- MD5 e00d23e149ce73066de37574bedd8c04
- SHA1 b5935fa092ee1d030859ae52ec88bbdf502879e8
- SHA512 a4a9c209105eae35ebc12051fc1e232c342c3ad854f49c208217462a5a60d659b63b376af96dfc2112c138d4853e1316a530f0a6725334378cedc7164df6dd0a
- SSDEEP 384:KM/0dzbj5pyPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eLX/HAG:Ku0FxpyPmoEa/h4Y2sDIVy8ofv
- TLSH T112629FF84A10A65C4C5BD5E6C8CC11E52C7D732382D969F59518350ECFDA3B893BB09B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
- Size 15KB
- SHA256 bde0e6f4e899e5a26f49d5ead8c37ab54fa78736d78b12f3f5764997dd42c95e
- MD5 2328e9ee5d9123f8751a3623ea2e6846
- SHA1 e6ef5235119497dbd67a25a331ece97b5fe0e408
- SHA512 dd81a4b349ef1bb88ce76b6404a4cf463f5b47e17b426f0bf3f3bbb35b3b117817ccf7c64ebee411491a60b1ccdc8789b22d47ecb2e7616fc51ac01547af9c51
- SSDEEP 384:Bw5DOBZojgJ4IlP61hu1wdvNd9KVRaAcP+AWRMAyaB:hvo0J4IlP61hiwdvNmVAf+hRMO
- TLSH T1CE727D7B9F50289A0A17A5FA5D2F16C82C07716B9BD88CEC21143901D1A9BFBB5F908D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\75696D2F907A53034E3FE8BB80963612D2FD82B6
- Size 101KB
- SHA256 3e7b3b40f9c7b9889e79d081a35a8dceafd98ec869419dc976e630c79aa86b44
- MD5 9ae497ab0f6a88fe6e5adca80f225817
- SHA1 e683fb8966a8bdf67753c33a514b85e86229de17
- SHA512 ec260af92060927cbd9f01cf796b7ce1febe3cc7da524ed4bf9be8516134518d62c9cb48d8658eb032a74733ba5cd4b4321e6d028014e5a5dc9be6b5fd55c56d
- SSDEEP 768:gPQUqpUo4Lpvxg3ZSkAE8R7MSDNWPgfLOCGp4q+Pn+3mKINv8PVrdsH4mLEOUshF:gPQiLpvxSAjDLpGp4HPdKINvyqWyp
- TLSH T104A33A275BD91D3B079673D82C0F3C9B1FBA0583EBE8C695A9DDCA0980D3C58427E265
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\7CBCEF5162967CB4F8AB18F2FF2C849491E2F64F
- Size 11KB
- SHA256 fd39bba515012ab17a462c599cccc1e3925326e7598acb08af9584ada960778b
- MD5 c240a2d80e1cd31c893dc2332c250026
- SHA1 017db7c983b63b01844b6c7e00b8c83e6ee6167e
- SHA512 7381515135a69054473d6239cc8d8c65622da27f62e8fc55d35100b4e201ed9cdd3d515e6c3157f144a0788e63426c75fbd15851d4ef36c0d3f4435b095d3ecf
- SSDEEP 192:3163y8FevwTUbtY1J+Nn9am3+j7VMirN2zsb0HjGPl2BadE4Pro15j75ywpskCLG:3qPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eLG
- TLSH T1A6429FFA8B00A4594D9BC6E7D8CC11A92C2DB717879D60B57414320EDBEB379E1F60C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\A8A62A61E64682F95986B526A21FB96A740AA2F2
- Size 20KB
- SHA256 7470ec373048411f40492876c0f7a3034d20bc0fbdc6efe1a07d16a1f8de151e
- MD5 4068d3cc3779b4be8eabd44161a16303
- SHA1 96bb78cb0dc1678414f076ea9b1c1f8ff5f2c740
- SHA512 47f09d3fe167b0a51324b5a1f643da3f78f8cfc02dc80ca96ff46142da15c8cdbd4d584b45a272b3f99f6c5b3ffdb444fb5a9bcf6cb6940b449652beb96ea80b
- SSDEEP 384:dOuxaCgTjk/iDg/lRsgM2hBfAWTlYsQPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eLO9B:ECgTja/l6gnhLTysQPmoEa/h4Y2sDIVl
- TLSH T19692CFB68E10580C4CAED2EBD99C51A61C3CBA33455EB4B1A140391EA7FE3BD81FE495
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
- Size 16KB
- SHA256 4296ec2ce0b9cb7fa223f112b0a1deba420a6990058446cec51570a38ea93c34
- MD5 b7a810165193b657a1f59a34674bcd2d
- SHA1 47d9cce1de59f80b994f17f453dcdee58eaabe20
- SHA512 ce4445b16e66f5d57dfe9af52afe509ed13ed2d091a51362c48b4b78310e0645a4f3048b9fa11e4a48c833a1aa7659141964c9e0162e5c55b2e5c0502df23b04
- SSDEEP 384:HalwSiO024YTWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMApL+fS+g:6l8ZYTWTToXJWTTogB7S/AmVAf+hRMYH
- TLSH T17C727D7D8F413CAC275790E8C8B943558D18B6E7DFB5C06D22983E09CA48A5A71F984E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\B0513C17AC20F8954723597F55ABFCBBE91DDFF9
- Size 20KB
- SHA256 4309ebef0fd83a60a4ac6073ef1cee7293178078487a0a67b93adb1344d3429c
- MD5 fbff9d500c34f4aeb06b15f917769353
- SHA1 dbce534b33498a61dd062cbd5af4726df5708fb6
- SHA512 6beb56cee26a871d03c18ed6c14a01b579223856f7efbcc2729733f6709bb06551b23234cece06e1ebc8924b4c8eebbb3da4575fc482cfea29ff596c1603ec90
- SSDEEP 384:ryXMNaMXM6wLPrrmYk+mexPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eLUyI:r6dn6wLTrGMxPmoEa/h4Y2sDIVy83
- TLSH T10292D03A4E40191A0EEF96F6F9DC21E25C1CB6034B4854B2A61C381F97DD76DC8FA0A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
- Size 11KB
- SHA256 7b61eb57053691992efffac50235c02d4acc382de4f4c028698276f8b6bbbadd
- MD5 b36f932bff5493cdd74755fdaa217b67
- SHA1 e20b4f066a1d3a78ff5e8200dbcb0dc2d3f3eed5
- SHA512 d40d4d0e0e86254e1b64eddd98daca3bfdf807086ac6c9563dc7b9db71a2e1947aac226e0a98120c86ebc87974db09f90ac87ef8d2c629c2132592a9dbb975f3
- SSDEEP 192:Zo+TzVNlqTfsgyN/de+c4sj8wkac8/E5oW65fBydFGf1e0lpBNDIIDMkkHdUZjk+:ZrzVsSpde+Vsj8wkac8Woh1B9M0lpDIE
- TLSH T19E428DB39FA0543C0E8154E6EC9C59890C58D643EEDBA0FE18183949A5A12EDF9BC2C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\CFCCBA9DAB0559A011620F23DC246FB3099B22B6
- Size 27KB
- SHA256 48b1112bd305e5a71cb6deebabdb8b319a6c08a25fd0c7daf4f0e5294ee3ef1f
- MD5 a63e8fee48dbdf786cde3ae0b8f768fe
- SHA1 d1f599d4c8954b6fefe43d3c768bc46cc4b70cb9
- SHA512 064c9d5e8331d2a328e89ba27c1a23c80c3c663280bd08ebec7bab31351e7b7a868c36422cf6c45d243d3de6f5606ff64ee3b9464795d89761003d77c26f1f59
- SSDEEP 768:OuPgEvIzFnieZPmoEa/h4Y2sDIVy8NQJQN:OuPRvIzFnjDWy4yk
- TLSH T1D7C25DDEE98062584D6F820AECC9B390BE2B148D47697C66756E204C73FE639C03F5C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\D02FE8E3E1AA17FC0BF0221BBB8F9F6065C9B8F1
- Size 13KB
- SHA256 a06b3961739d342801ed96dad8b00154cb140d8cae6631513978ce45edb43347
- MD5 1631ae67ffd31139c319809774065da3
- SHA1 63dff00949034f105da5cce8f77a9e6b95288453
- SHA512 7bc7ddda40e3e1e33dd06ae65f917608e5e21017d9bccee81f1e9ac0f6fa30f05fe9bf0ca971426081e6b3e42c8da97cc41c1e95b6011429495afdf75e3b4856
- SSDEEP 384:G1zuPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eL21LP1WJ:wuPmoEa/h4Y2sDIVy8bxO
- TLSH T1C9529EFB8B0064084C9AE1E3E8CC11E96C7E6317D69DA0B56558320E97DA3BDD1FA0D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\D04200C11BF95A67571F3ABF82691C2AA376DE6F
- Size 12KB
- SHA256 a70d4c4c45031b6803c361d9213e8504a545470c7013eda48563ccea1f2c263f
- MD5 b3fc4dc4396a7e158f9d41ce3500134b
- SHA1 b0f591a252f32e536e6f61d6f3e1808a9a7e1cd6
- SHA512 614283c15f9835889b28e052640a37a9d5bb775b1de97c50f2aea39153d24935f97963e5e066cb3c08228fe26949e6dd15bc0163df815a04f4acf7462c863e91
- SSDEEP 384:dtPmoJ+N9aRVnh2zY0DE2Ba/rIVy8eL7Hmk5:bPmoEa/h4Y2sDIVy8u
- TLSH T16E429FFA4B00685C0C9BD5D3D4CC11E92C2DB7178799A4F5A468320E9BEA3BCD1FA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
- Size 52B
- SHA256 d9aa3a393c20e7ef433066b3f80d7304086996e8d3001abfdadeafb45138de90
- MD5 54008a93488a9d9885c174e8da4d809d
- SHA1 76a49e0d545e16738bdc89b4046df425add8476f
- SHA512 89eea6d1fcd4b74b57be53c788d46d65b859910d0e17fa0789d3c115a4572ef46fde23f506e249aeccb9383d3d237643d13d22302d0917547fcbc61693909bae
- TLSH T1D890024452519AE0E054C1B90C0190B514723E105490431676925FD114551D30236040
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
- Size 12KB
- SHA256 d34dd4beae411db4da878af1ab5891ce7e6d190de196d4a9604d35957c052213
- MD5 d5ddee8ba99554b3c6e524d76b2df1b9
- SHA1 04df24f646a2436cc0e79a1c1c0b6171f22dea46
- SHA512 df03d27cdb1619d71c0cafab54aa8b8a248fb7f6641246bf48c23f3e10133f2006ba60df0aa131cea42865dbead62aba90d722b05620623669c8bc84c4ed3a7f
- SSDEEP 384:Ze0KoIsSpde+Vsj8wkac8Woh1B9M0lpDIIDqznR8znRT:ZN1IDrecsjBkaBxh1B9pD8KT
- TLSH T1EE42AFF39E9054380E8164F2E9EC55950C98E243EDC7E0FD2D083949B5952EEF9AC1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
- Size 11KB
- SHA256 2424c4b6dfa72015601140804eb77c70448116c3949935ec20d00d0d0e9e7cae
- MD5 1e2915c7b2f8c7bb1a656b64a19ebd5a
- SHA1 6312c9bf52d66d2f30f918d1668162c41af254e9
- SHA512 4e27c2dca6a35ffc53c4b02ab2be0da1c5881d405ba5d0b910d4be17bf6d71794c1b2bcc3e27db714b1107e0a5085d49b684ae67f1a54d74ecef3426051bbc30
- SSDEEP 192:ttwfNlqTfsgyN/de+c4sj8wkac8/E5oW65fBydFGf1e0lpBNDIIDj2bRdykkVf2R:bEsSpde+Vsj8wkac8Woh1B9M0lpDIID+
- TLSH T1B7429EB3DED0643C0E8164E6EDAD69590E44E103EECBE5FD2D08364A94D53EDF8AD085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\F1E25E5EDBD3A55ABDDBB8E7829D6ACA3BC48C02
- Size 11KB
- SHA256 1362cc1884a13ae716489fbd21c2ffc0c55f95e4409178bf896c18adabd97ef3
- MD5 dacc91e095077a811da9daf0ab25ab4d
- SHA1 c0e9f06686d36094022a18e4cb359ed5b65e2063
- SHA512 4072161f01e474a13c7ce47a0d677095891f37a8d3e21649d0c05d872016aa031061c3aa881d49c530c92780cbff15d93cc72c5705fdfd23a23377ed71d1d9fa
- SSDEEP 192:V/y8ysK1cURPAetXIs9XgJ4M/9702l/nKh863lhu1wqsv6TAQ1kd92lrdH1RaGTC:VyacXjgJ4IlP61hu1wdvNd9KVRaAcP+E
- TLSH T15E428E385F413CE9095364AA8D6FE2C01DB4F2579F954AAC59283504D8CB8FBE6F405F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
- Size 11KB
- SHA256 036fae103a80994af0a2a1be9a27dec1a54cd6af6b0030c4f25ffe96e3876915
- MD5 4c13de04258bc5efc3c372c34fca13e0
- SHA1 135a3db00f1d1363989429cd7ee283cc82128bd7
- SHA512 561b4d8e0c71b14477c018a7f0864087c8f4f9b508f392fc2c355cc23a35ecb94f3d6fafecc240504ca92c9032a48bdc80ad010eaa63dd62d7bcb5cd498c874a
- SSDEEP 192:mo3INlqTfsgyN/de+c4sj8wkac8/E5oW65fBydFGf1e0lpBNDIIDlzd0kkj3td0T:moYsSpde+Vsj8wkac8Woh1B9M0lpDIIv
- TLSH T1A9428DB39FD0543C0E8264E2E9EC559A0D58E243EDD6A0FD2D08390A95D63EDF4BD0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
- Size 15KB
- SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
- MD5 96c542dec016d9ec1ecc4dddfcbaac66
- SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
- SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
- SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
- TLSH T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\scriptCache-child.bin
- Size 1KB
- SHA256 4ddf65b88800ef9a30589a21155eb1650d8df98ebd3d88735eb1299a6b48a08e
- MD5 13a75f642f8c05fca7cc25835ec3ad43
- SHA1 20c1374577634c317f3c1185412618e3e90809f2
- SHA512 e3664cd4f37026a47e05f3ffb4cf1ee1e29ba4a92084b04ca274040d4a104de14edbabd10ceb67e7328578dcf586e49fb8bc9c6a72d1404467f1fa69314c3d4a
- TLSH T1353165808B7A8036D479803EBC63B5743EF4D28592EAD50377D5B1FC2DE2B954B91A08
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\scriptCache.bin
- Size 10.3MB
- SHA256 3ef091b372212c7d9da9aa1866d0ab0f2d0488afdf45b4a7aad0c5529f10478d
- MD5 13177e0d391b59cb2667358597ed9c35
- SHA1 d0b5bf2662e30043bd7734fe57c3b6c0e277a4e4
- SHA512 c4b083fca6b648a552f224b68937cca03582dfa67c0c153c29b6d9847ccf4f19057aa826b13e0a58f5d8c163e60f43dceb57b945baf1739d4fd166bbcbf9574c
- SSDEEP 49152:oAVgSdNHhyDzwH6f8Nb55vc38zYPHpJFVFwIdhCXfJ9/3UbSQD:RgYy/waft5PnR/SRK
- TLSH T104B69315EF664E23C468027A48FB53313A30E04547EAF3276F8F7129BC6B7A91D8995C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\startupCache.8.little
- Size 8.2MB
- SHA256 202e130e60dc95b75110b5d56176386588c0585de2747e1feda26ea6e994ec29
- MD5 f4152498601068c662477fc6dd6dc85c
- SHA1 f467caa80b4f742a1502695d0146f9063f34934f
- SHA512 a52b8b196f191800f8f0376d5fb988b87ba3cd838258cb5b07ce7bb01e3e669ecf0a24ffe9c2acd448e336d8c07628f49bc52c39e4d3a4aaa355b3b7534498df
- SSDEEP 98304:lr3ELqJCeeNr6Iqd8fBHoYi6lwvvNTngNeVnKFGH/OR:9uqpkQ8pxiuw3Nd1GR
- TLSH T1259602B7B3590697C425191AE87A0A393763414203E166AACF78533FFEC724C1BC6E9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\urlCache.bin
- Size 3KB
- SHA256 c5f5122907ac979bf9beecf908ac402ca0718da24e6848ded27d2f1802d72fa0
- MD5 7c83e07d590946c1f43ac755f413d04d
- SHA1 74219758130352380854c318950b92bb0c4a4af7
- SHA512 5fdcaf4cf14c4510fb58d76231db54e8496dcc1cd5af0218584da792d10d42209a93092614e267025e5c31b1c3a1076efeb0c8d3039782020b6e3a38bec0717d
- TLSH T1EE81B442E43B743B7D66A8FBBD858075F820088ED1CD15DDF696639420AE7DD038EB1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 76ec8b8011cb1fff37b809f8e13fa0b2abdc0d93766dd5cb85357e0bee477e1b
- MD5 26f49d85fcf521226abcf6f34aef2047
- SHA1 d685e76400fbc39d070cc85ad67b9ada53c62723
- SHA512 42f0fa26a760c4a5976e8c7d0fcac4b9f0604db61016a981e38e7ffca5df7c83c5fc42386eaf84c23567654f62d173a07928ace6111e4324fb277e9fe7000b86
- SSDEEP 3072:j3lG9eMA5gY22+77fMiFhFk3B0GzsvgLKZ8ZS:p0euY22UPhFk3GvVZuS
- TLSH T1BDB3AEF6DFA28D7D64FFD42D5A82C83EFC266400F3A73015C8236751A2C6BB46679648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mehrjxxh.qkf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\AlternateServices.bin
- Size 1KB
- SHA256 95c9e350a1685fe2bc0e8d0ebdcc2ccedd2769481002cec56bc9f2bec68ed6c7
- MD5 926794b86bdba179f38d1bf054498353
- SHA1 dba9df6e6f2652698b3a32fdc2e8467317a63b17
- SHA512 4aefff232cd92805509981c5d14562de90054d1711fbea4ee2801223c480561faba3bc1d012d5bf805d07368adf2d14acdbd943ca098c1d7b755642568438329
- TLSH T1F9214CB742B71234E0155AB8B81EA4044D77A3C996BB50491761A0A32642DAFA0ED054
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\AlternateServices.bin
- Size 1KB
- SHA256 d07ec08f9a825d06cd7af42ff68b8263e80b0c0886e3659fce73c0c389dfa555
- MD5 f8a21f6ac20674bf879a9b32fd39f194
- SHA1 739ffa8d04132ccf8d9326a33c2737ed18dfc286
- SHA512 911d34b26f8a58e9e708f95891141ce502e4b36a2609102db6c33a00f9cd67e160eb17003c14e4f6871d77994e4b762cbe9f44fb2c2976589e921ef70e35ffee
- TLSH T100214CB742B71131E0144AB8B81A60045D7763C596BF504D17A1A0631942DAFB0ED050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\SiteSecurityServiceState.bin
- Size 1KB
- SHA256 3e51176c320658800b1162c04ff68e200b1ecc9dfd101cabfb27677baa30b63b
- MD5 0594b88dc7bfb58495e5db2c38d2c2e3
- SHA1 b5c4797ed491682962fb71a0ce685b14f16c3480
- SHA512 238a9fbe053e97a69c0d24bf95edd01a42223f0324b9babcc18399bf857855d02685c11d3b2b5c6144312c076025764d09f98ed3b9824f5418162fe59585b3f7
- TLSH T1BD21EC35889FC535F0964AB624E944500D6E334A41B7F1A93EA0C6923280EF520AD391
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\bounce-tracking-protection.sqlite
- Size 96KB
- SHA256 07389aebeff04f1d370ad4b1c9fedb5811035f354bb6bf950a4631bcf14a88d8
- MD5 1fd6bd348a985b76dee8f0051337ddc8
- SHA1 32ea4768657064b3ae4c7ffa2aa8d4cbeb044afe
- SHA512 05d81d1334e42cef9ec183c8c8db20721c286b8c1e2ba7da80322833d8488bd58de0d6eb458970d33acf5b525b74e249824b1a1b918b78548e2baa288dced5ce
- SSDEEP 12:DBl/AWnQ8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLPQ8akrEDE+vED8YfAlO
- TLSH T160A3268F1A742691EDC521B1D7829EEEAA5EC32DCB17679216A040B69D4216015225B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\compatibility.ini
- Size 198B
- SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
- MD5 ce9ef13caa8a74c25157b184aa038475
- SHA1 db03a9935d8bb3ce6b120aca98feade536805160
- SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
- TLSH T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\content-prefs.sqlite
- Size 256KB
- SHA256 cb094929393d9779bbb5cb44da04caf0b304b67509dc99e4f9b99b77539e19d2
- MD5 be3c562ea7e8d1c8e68c790481914f4c
- SHA1 dd66dd963beafa2bd4f9a4aa2acf615d95b35a61
- SHA512 ddcd4ac6df0a5307fecba86a8ea44c74836c6425608ecfb4dbeed7b847a639c59f9ef326afb1bf0d98619368f0e2f7c88938c4eb175979090aebd3af556a748d
- SSDEEP 24:DLSKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D2Wwae+QtMImelekKDa5
- TLSH T1644426174A917408C0B014B1D4636F22AF3D405B8933E7B23ABC183A4F886AAFC791E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.bin
- Size 29KB
- SHA256 6e0b93202003c6174397ebbda82c1752672f99351f88ac4d136536c7871dd1dd
- MD5 0d337b7e5bc179dcd9ed978bf1089d8a
- SHA1 28e827f6c86724feac51ae91e20e9d5249165b4b
- SHA512 d5154329d6497408216f11331a9d4b07b9edacfb972c93ab4193f11e25d5adfe3880bbf60c743b23d6339911dea966f7b6d558a4d71eae46d0593a0e8aa3763f
- SSDEEP 384:nboQ79oCyj1P3yJmjtNqKjtF7cwCGcmhuQ+ERCKoopQblfvNd66JozGzgC1jd:b99U3d7eGcmhurCCKoopQbRvqE/
- TLSH T11ED2FF84FB2A953FD41412BBDCA50B042F79F88A59192F573A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 3eac62d4342582ecce85b8b99be18df7a6b5a8e11a9925650eb0208c3002f229
- MD5 1794996956069b1e8887bc5e8bd3c58c
- SHA1 d5a17b756f23ba35820b0bda44b54b17b191f7fb
- SHA512 e3e35ea3923037a90aed4a0580e022ebdcd3671a80f0523ece6f46ac749be0f2ca6d890cc0e2ab5859e0c892650bd51c41f5856c5579ac254e88a595cc9443e0
- SSDEEP 192:TA/1d66JozGzgCl6mc0dKOv5zboPR9oCyj/dqj:ENd66JozGzgC1j7boZ9oCyj1K
- TLSH T198E11FA8E629823FC004027BDCA61B454F39389A9C4E3F29719C651C2D573ED76DE1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 2b570e06c16fa5ad31712a4b3887ff12e85000cb10e6862384b107b36a373ee2
- MD5 4665c24eff4f465a1cf158dc53e1721a
- SHA1 3d892515837ad990b44a9915116ddcb89d409c3c
- SHA512 d2b99de25c9a9fb042801cca48411f67294a80a1b4775004e3f50ca81dfc3ef4abba386c45165decba44f6e63bd643b1d7d960ddd58a7b48d6546fd1af439762
- SSDEEP 192:oA/1d66JozGzgCl6mc0d5Ov5zboPo79oCyj/dq:FNd66JozGzgC1jAboQ79oCyj1
- TLSH T1ACE11EA4E628863FC008027BDCA61B454F39389A9C4E3F29319C651C2D573ED76DE0BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 1c1b1ea55f641384e7543f6f6099a638233b37b6a7f26d0d5e8bc1759a939096
- MD5 383bbecbabab03ce1b5291de4666ec2e
- SHA1 dfe3ba3e54928091056aeb9c366a43c9b409b831
- SHA512 bdc04b333c369a79937479c85e5cf2f01544145f2702a4322ea26cfb90f506c08bc02d9f961b4730754319574958757e5c5963b09b67fd57323dcc13d2336ceb
- SSDEEP 192:TA/1d66JozGzgCl6mc0ddOv5zbohZoCyj3xI:ENd66JozGzgC1jUbohZoCyjW
- TLSH T1D7D1EC68E629463FD404023BDCB61B410F35389A9C9E2F2571AC641C2D573DD7ADD17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 ff54a784b0ac37de7a49295f521b59e020344ac20823f2cb27ed50616c487933
- MD5 22fcace819061106f7ae7e1c12c0c9e9
- SHA1 5b4bbe1229bbf2d6fa3e9d8e9e6dc809a5f4a305
- SHA512 ac918bac51be7dad75c435b1cc4237f95198944cbdef2de09aad1da5087b032abe42fb6cbb4078c50595bc6f7b9dd99c2c010200c138966e40d4b3ae3b10f96b
- SSDEEP 192:oA/1d66JozGzgCl6mc0dIOv5zboPyZoCyj/dqj:FNd66JozGzgC1jdboKZoCyj1K
- TLSH T13FE11FA8E629863FC004027BDCA61B450F39389A9C4E2F29719C651C2D572ED76DE1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 dc53f6a20d1b6a5f35da126b81edadaf4ea06cd9b634761a41b9ae49271a2e98
- MD5 91f061150232806ab2ad67ae83177609
- SHA1 c6e05e53435a6cd7b4756513771ad872926dde47
- SHA512 2924d4fbcb5b74b9586ab2a9669bc3361a8ae6c3ebfdefe7e55a8a8e9ea3bf7f9a376f942b0ad59a8c28d5b4e02c2a5b1d27d6e8004ea857658f84bbd3bcbf83
- TLSH T16D61A898F228863EE444423ACC925B411F747456A8AF7F2A34ACA14D1E473CD77CD07E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 79fc00b78ae3b0917504afcb806a222a6ecc3ad6e21d32d0b7ebde22853aa67b
- MD5 80818560c72dfa6c80e4b6ec87f1912c
- SHA1 e67265b6f8b7a0ad9d4c7a26c6295a043527cd44
- SHA512 c94fb68fd8b84f1617d4c261b866adccef8db3ff6e1a94eb50d456b82898363ed063291b12ef31da3facfe69197546c3ead6fa61629065feb1a015407fcd582b
- TLSH T1EA217C5E3BF94D6A5C87E69C7444028E53A14E4B048B1D475D43DE8DCCC1AEB32AB43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\events\events
- Size 120B
- SHA256 a190c8f2a426af41672f6ad7c5a23547a6835f0d57e12f8eec296def73c3fdba
- MD5 e2f4d78707ecd199be480ea7d630ea19
- SHA1 e80af0d55273e3bb23ad48634ed093f809c60ea0
- SHA512 b0bb99c204f73f24d5c8aee475500d5d47009acc321ebe4cc887cb7f354f5f75b5b1189a80794d5cf877af885089828bb35d1995b902cc5abccc0fe5c30cffdb
- TLSH T13FB09B4D51A40D5E954564545448854C57815B0B04D719979C05CD59DD14999706E065
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\0183a00c-3827-4152-8a01-309c9c9d0870
- Size 883B
- SHA256 e56e5df3b6c4d1d2f7ae19122a7b039d6b86084e616c0959551861132bc8dd8a
- MD5 dc7a86e8103c4c04bce131f81072f3f8
- SHA1 03b8bce8837db69aeae4ad11fe6a7bc86fde9bd6
- SHA512 5c863249229bde09f671d8afb73fb71c72220b2a19a5ea629858a56e08094de6b7e6182c3954be08ee8da77ff07de466f00acf856cbe2947d7cee70f24ea4f3c
- TLSH T1EF116381A1317472DD68C30FC0B4370357F47563C0CA80147EB14A180D7AA2DB3A764B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\5cd8862d-af6c-478f-ad17-d8d934c480cf
- Size 235B
- SHA256 dd3726eed9ab37ec4516db754243a774696dd9a9ad4e694979dbcb6230e7d0e2
- MD5 a681f4f09342636f52bdb529f824a8da
- SHA1 c6d22bcb5675dff6aac844c5c1f853ca44f8fc21
- SHA512 95265e326372055164d917fbc68219ac91631b90e775985e9ebfbfb1978f38d949cb7b1c7c461329ea699fe4bc9d53b2bb1b667ffcf28187c78fcf32dfa33860
- TLSH T1E9D0979829D8231C48200F0BB4A028C6309C8C3318B0A8109A90567489BEEC543A286B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\70187a14-cb99-4477-a4a3-86f81b5cf3b4
- Size 15KB
- SHA256 3d215364695319e65f72bf828511c3c3086dd5c6fb711587afaa7b4466a20154
- MD5 a4e2837166671402e4d00f1ace21fe8e
- SHA1 94207379567fd79c48242bef2cfc7a3fb795fc28
- SHA512 ade2906e73bd52bbbadd4ec0889e2775a8bf604975e6942255ab45a5e93fdecc8c0b6a77cade1b199ab06a504fbe04356eaae4372a6a5d1355e6a365a53c411e
- SSDEEP 192:n4gBmtKyq/eZBwiq969pVuMoYKo3zxJaRRyZjuLZhW0DMy19BAP7zmm+:Sq9vvYKo3lQRRyVuLZhLpm7Sn
- TLSH T17E72C9562830597A8651E3A994FCBFC3E6F528CF4C418FCA9BE4BD085DDE0AD112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\71b5e705-ae58-425e-a105-303489896185
- Size 235B
- SHA256 a705037a931f46cad491b17e67c9f1d856d2bf021b62f9b2a360e4f6c62e2ced
- MD5 60d8439a57f0c4ce295ec08cc143e9ef
- SHA1 f8367cea4e2eb7ea3b69996b3794b486e525bda5
- SHA512 130612885bed94515a1f0cb011a174ed86906ef216da4a0ab2ca58531ed490f1332c2808731d3ffc8984649e58297ebcb4bdd67d7b7df02247778addef1f1504
- TLSH T119D097801498235D48144F06B0F069C630884C3314A4A824C65204B89BBADC8022281A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\7917695b-b828-4bbf-932f-7765fa13b14a
- Size 2KB
- SHA256 b41cd32d33ea5c91aaaf55c19802c94d64f0fe2222aa776474d74bdd89d7826a
- MD5 15fcbbf37573d577339179770ac8efd5
- SHA1 b41ced10942c2c38aed34b402b1682d23f5e09b4
- SHA512 153233eef95928f7ee53351c2c473662ac8255974fd63efc5d8e4d98f50d64dc283d98718a97a05204d4c694880e219b1b49b0a3701b12881124e119ddb5958c
- TLSH T1B741546C75B85C379CDAE14D9592338E63708A9340C31C536E61DF0C8DA269D337B46B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\f53d48c5-6906-401b-b449-87dcc55ab58a
- Size 886B
- SHA256 7a568958a5c9158b41f06de82aa8220e0cbc395ae1aafaba0a8f725f49bc195a
- MD5 42c6f419b4f8d86353cfd51bfd408dd7
- SHA1 1fcac5bb1ec36e4020ab9ce7fedebfb59ace7dee
- SHA512 1d5ed86b98190e668d2ae6a98b958f297f8b039da2853c5a2ed2bdd035c32cdaded08efd02a832bd5b63d3873e349d24a5c75f9852d9856b56ee320ade0d9cba
- TLSH T1DA1163C19575B872CD28D34BD4B03B0347F471A3C0CA49243E604B0C0DEB62DA3AB20B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\domain_to_categories.sqlite
- Size 96KB
- SHA256 0581cdbedeca93191ffbfd49f28cefb44c64a3f8d7d9c1fd00f8fb58f8a29d20
- MD5 8bbd85487e190bb30558e4a6e44a8dbc
- SHA1 110892881aff9d27e99ad894dceb3a0fec6a3663
- SHA512 28619dcb45a5ee7bdfc292f827141e7ce800469e80b2cfc032f16e185624e2462bdca51b0fa2fdef793ee0a417be32695c1e66e849424222de6c62271cbf9c7c
- SSDEEP 12:DBl/jH/bUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLLbv5XvtQhP8W5/b
- TLSH T110A32B1F0B5CBC40D4C356F16D8319067634D50B8913BFF13B9D84104F066481C35AB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\permissions.sqlite
- Size 96KB
- SHA256 6277e27ff1939b79322d6fbcce64a2efbce1520e8c5dbf83473edd46821a4ecd
- MD5 af4d8b88fd08b6cb64758ba96d9dc313
- SHA1 12f9763969a88e680636b3a3dbf8dc1e73d36283
- SHA512 59e1ac2cc3a257508dc2e0027782bd822d3bbd731ab9799852ee80e3ae160d2960ab319cfd52f2f2e40529d99db36e5c4e2d7ec09820e860dd8d7cdcc16748f4
- SSDEEP 12:DBl/6PRbWla0mwPxRymgObsCVR45wcYR4fmnsCVR4vJ6A:DL6PRb5sh7Owd4+UJ6
- TLSH T173A3C0874D7C69D2EC804633AEC256D8603D191A442FBA861E8244774C035C5DE05EFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\permissions.sqlite
- Size 96KB
- SHA256 60f8706d0109558c4a5b3ede7abbef9f7f851418cbd222195b252d550bdc6ee9
- MD5 faeeac50ed43e187e644df11a91591d5
- SHA1 92d77b78298bba90a9606baeacf7a4504f02d664
- SHA512 0bebc2eb4c46adf9bc60c10002d7466817f8ed625ddd4b093830f411d6b3f5ef7bdd727c71c8ccaeb3286a07d5952f5f8b29f2caaba2e3e355acd27711963eb9
- SSDEEP 12:DBl/0nHbWla0mwPxRymgObsCVR45wcYR4fmnsCVR4vJ6h:DL0nHb5sh7Owd4+UJ6
- TLSH T106A350874DBC69D2EC804673AEC255D4603D591A446BB6C61E8244774D035C6DE15EFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs-1.js
- Size 6KB
- SHA256 ac10d7a4a1e131e88736581a9a5b972e809d7581069136903aceca9822ee75f2
- MD5 63182479e3ca007556cb35fbe4ee2545
- SHA1 d77207ea908309846d8f129296c280c7889ec317
- SHA512 439957f51075bbb500fd4a266badc23f26a970cb84aae50c2608aad728a5319e5c7942ec418409678e03698dda640d007bd15af431a96d0a26e8d76459b432de
- SSDEEP 96:xHlwUTUnqGqEfxX01S1zSmFcbSSlSdv9jHnHRHZlejyiBw88n8L4cnihK:0aREfxkA7FcbSSi9ZTiBw88k
- TLSH T185E13F789008CB6F74B676ACAC6888316AB2023B7BBF68D750B554C4055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs-1.js
- Size 6KB
- SHA256 7ae753ccf0a139d4fd5bc603f7a744459b34407ca3961b1f3228777c2cd3ebf1
- MD5 0695f4360a3a0187a5894506b9001e0b
- SHA1 33cf962c61e6732076497cb6d28a11cfb2513781
- SHA512 18ba7a621a31f066902fee19222d9b7afc5e9cb02ec47b984adca4ae53d07777dd38ae131cfa873c09863d9a7d9e4215549e9deab35a7b166c820f361addffee
- SSDEEP 96:xHlwUTUnqGqEfxX01S1zSmFemSSlSdv9jHnHRHZlejyiBw88n8L4cnihjGS:0aREfxkA7FemSSi9ZTiBw88L
- TLSH T100E12F789008CB7F74B676ACAC6889316AB2013B7BBF68D750B554C4055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
- Size 6KB
- SHA256 d1e94f57ce663a8b0ea76281d846660aae30b7ca64d063208d00dc4d7bb0b9e4
- MD5 11607b669d2003d7f90d41e306c29626
- SHA1 61e01546ef47e30895af92e3beb79381c9416738
- SHA512 fdae896772b83435c58f5b0d090f4e3a596afd53301b1fba04a11496f8a2046dc904489e4d03842de0148a3a2f6bf74e2eac24a750ee754728815d011c3cf82b
- SSDEEP 96:xHlwUTUnqGqEfxX01S1zSebSSlSdv9jHnHRHZlejyiBw88n8L4cnihK:0aREfxkA/bSSi9ZTiBw88k
- TLSH T1FBE13F789008CB6F74B676ACAC6888316AB2023B7BBF68D750B554C4055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
- Size 6KB
- SHA256 6bc9c6af25dc6a2d39ad755dab7eb190efd93134f45297c24f0684b8c447b3a5
- MD5 9c202487c9145a629bcf62b1932209c8
- SHA1 2828e35dced103398af0c81c96930819d9883cd5
- SHA512 608f2c57de6c44d189460431e18bd8f22bcf5d91240f6bfa45abf8a15785e1b80b09227984c7ec3d04c4ead8515380ba15a5a4bb09edf036519811ee7a6a4f6f
- SSDEEP 96:xHlwUTUnqGqEfxX01S1zSmFemSSlSdv9jkTnHRHZlejyiBw88n8L4cnihjGS:0aREfxkA7FemSSn9ZTiBw88L
- TLSH T141E12F7894088B7F74B676ACAC6888316AB2013B7BBF68D750B554C4055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
- Size 6KB
- SHA256 b1e5416fc40a633b787fd85df3bb6e8390b22e741f45b3e343f47c438be135c5
- MD5 b5da13898bc7a7a1b141f0d30eaa5883
- SHA1 4f94ba55513d4e5b4280a33dcf6d3b01f8bdcd97
- SHA512 276038a0a172a2c92357a4b2c89555540d48ee1ba7cfee31cc0f1ab3496cce31cfa6c8e73dfaa664e767ddf6cd8b9efe9a00e1f0911bf07a2715a080a66619cd
- SSDEEP 96:xHlwUTUnqGqEfxX01S1zSmFemSSlSdv9jkTnHRHZlejyiBw8On8L4cnifBjGS:0aREfxkA7FemSSn9ZTiBw8ODX
- TLSH T1F8E1307890088B7F74B677ACAC6888316AB2013B7BBF68D750B554C4015CF3841F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\protections.sqlite
- Size 64KB
- SHA256 17ede89dbe62fe12796fe6eb7cb3e371dd058299c4dbc3c103210439259398a9
- MD5 46af60692fb8e773e3d4b5d45ecfd6fb
- SHA1 e87e10ade210f83e774d5d43e0058c3bdb63df93
- SHA512 bb75958af15094d8bcef255bbebfa3e6cce6ec06f7b4b04662cee5d3efb6b548a8f9662a9bbc11e84c2fcb116c30f380e6b060e935360d481cd119ba74c464dc
- SSDEEP 3:lSGBl/l/zl9l/AltllPltlzgRollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wg8:ltBl/lqN1MR4BEJYqWvLue3FMOrMZ0l
- TLSH T15453225E03383021C089137227C323922F3CD2BA93232E832A100C358C0A022B822AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
- Size 288B
- SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
- MD5 948a7403e323297c6bb8a5c791b42866
- SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
- SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
- TLSH T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionstore.jsonlz4
- Size 1KB
- SHA256 a586d847a28003aa6b83dfa04960319eccaa49e1459e62eb17113892b31990d9
- MD5 b6ebd223dc2259470982419a80cd99f7
- SHA1 d9adeebe8d174564b19732d8d388c93b367f7941
- SHA512 8438a31c41617808756f5fff23924c4142c1d7adb2355aa87c4b46410f4cf89c6136719a0fc883b886684492d9f7d4680054539608861d85dbec8f2ae699a1cc
- TLSH T1DB21E7637D6B6EEB7F109066E06C8FF5B64530674C5C04B0D5FD9B0790D5259230E12D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\storage.sqlite
- Size 4KB
- SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
- MD5 701bd81ab9bb9fb95ec393a557d20be7
- SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
- SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
- TLSH T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
- Size 48KB
- SHA256 19ed0a74dba4f26c292f1352745ad483e44fa408b866a45f8a43092d7a0e8502
- MD5 c14b083d6335ee27072aaf760720488c
- SHA1 f7fd3610adb356de2ffa9dd441a90598c46dfe71
- SHA512 1582223030a82c029379a7ca6ebbceb15ff666370928df662e1a4adfc7de080827069223bcc2f8a330dec2bdcd9dbeb32dc8a2ec36b7be233bae5cb09ab089df
- SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkBN:Oa16S6CKnqlizbxV+2xVeU7X2B0mKN
- TLSH T1E7237F8E3F07A511C53AF0B178A08D51BC5E321D07222AD669D0DAE4C8F215AEA1F9B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.1MB
- SHA256 0259c896f15d186cf8b66952ef1f5d58010da4a0d7b2826ba377312d01ed2605
- MD5 dd852aab038c4b01e43056396eb20fb6
- SHA1 8cd78f1fa0488b288c431ffb4f837f99b8cd5f3c
- SHA512 693a50c277573464e7452d281f4e4f58eacbab2b693a73f22e7c0cd90db29f38248e16e36c4dbafd09ecd0e494053680c4466b080eb783a02dd4195eb16bb73c
- SSDEEP 24576:MxMyD7VRPaQRjujY8K43+3WSbrYyT2Lgk+7HGplmDiuQI+uk0AD:MxJK8KjYydgk+7imDifMk0A
- TLSH T1CF362AF820D1A257F3414033664593EF21EFD00C6027DA085BE99AE9A574CEF9E16B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 0424d662419e27d56c96b29e467c3b7bf970a69cccc8c4962d43676cd3d1def6
- MD5 03616360715b9f043404b1fc765c7387
- SHA1 0b200a48f72eaceeba6ec4e55dbe640779a3cb72
- SHA512 6c3c9baa628db7969c4c7ba0531f2181b5ac4c86c5e4eb208506257662f2cea86090711235e7bc44435f31c0a6f4fa94cec2b8af3c269de96c12bd72bfa9a7ee
- TLSH T1C171820CA61CA4BEA65BC3C0E6447FA78BBD053370446458DAFE460C95FB5FB163621B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\xulstore.json
- Size 91B
- SHA256 4c94c6093ed1a757ae21d09eef9a845c2e906a7f8a5986d8f17f21c2b62e5b29
- MD5 fe6a713d6675eb75dd09a611cf0ad139
- SHA1 41c5291dc72f2322097d36b428a4874e3f9c82c2
- SHA512 a4fb580a84fda4c781e613389c88fe01800274458285fcfcbc1b55f93a5e346c47719312a6bffc51eafbd21027710c0175a8e05a28840d95b1972f7e32c46cdd
- TLSH T155B012B4401FD4483F28CD8A024636803D25500050C06126B4531C64514432B8D0C30C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\WindowsUpdateService.exe
- Size 235KB
- SHA256 fb95c1329a3b5434636a985775b10095b38113605c754b1069725ee1103057f9
- MD5 57b46b4f62bc6e04a42b277005dfece6
- SHA1 c0892026e97dab08670aa22f4c8dd8f421d56459
- SHA512 d38a7124db18107d6e3d58bef07ee9aec959d812e3caf67415e132efd4cca99db2ab71e4ded84c8b8bbd026766e09ae685c356c63c2dc62f719b2bd1cb1fc1b3
- SSDEEP 6144:6t4KndG5MXZnEiO3IEinIYN2GUYVG7xj:iEb3qXN2WVy
- TLSH T195348E19B7A50CFAE5B7C179CD424946DB737C4647A0DBDF07A00A928E13AE09E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH