IOC Report
qJKiVKZdFk.exe

loading gif

Files

File Path
Type
Category
Malicious
qJKiVKZdFk.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\$WinREAgent\Scratch\_README.txt
ASCII text, with CRLF line terminators
dropped
 malicious
C:\$WinREAgent\_README.txt
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build2.exe
MS-DOS executable
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin
data
dropped
 malicious
C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
data
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230170v1.xml
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230172v1.xml
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\76561199673019888[1].htm
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\build2[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\sqln[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG2
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\UTD5SFEV\th[1].svg
SVG Scalable Vector Graphics image
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\UTD5SFEV\th[2].png
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\XP05FTX1\4tiHI4cTzqiixje34Lb3KTOm39Q[1].js
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\XP05FTX1\th[1].png
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{05ea5f90-4347-4a95-a7e3-40799835a752}\0.0.filtertrie.intermediate.txt
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{05ea5f90-4347-4a95-a7e3-40799835a752}\Apps.ft
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3bc3f5b6-b1ab-46e4-a933-7d8002b0a491}\0.0.filtertrie.intermediate.txt
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3bc3f5b6-b1ab-46e4-a933-7d8002b0a491}\Apps.ft
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\0.0.filtertrie.intermediate.txt
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\Apps.ft
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
data
dropped
 malicious
C:\Users\user\AppData\Local\VirtualStore\_README.txt
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\GLTYDMDUST.mp3
data
dropped
 malicious
C:\Users\user\Desktop\GLTYDMDUST.pdf
data
dropped
 malicious
C:\Users\user\Desktop\NYMMPCEIMA\NWCXBPIUYI.xlsx
data
dropped
 malicious
C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Application Data\Application Data\Application Data\225a7e21-4654-4142-adcf-9fa08e829768\build2.exe.bgjs (copy)
MS-DOS executable
dropped
 malicious
C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000003.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG2.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
 malicious
C:\Users\user\Local Settings\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy)
data
dropped
 malicious
C:\Users\user\Local Settings\Temp\scoped_dir5952_991612011\10f5ef49-b826-4bae-a469-4fe1cdaa885f.tmp.bgjs (copy)
Google Chrome extension, version 2745333763
dropped
 malicious
C:\Users\user\_README.txt
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db
data
dropped
 malicious
C:\Users\jones\AppData\Local\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db-shm
data
dropped
 malicious
C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
data
dropped
 malicious
C:\Users\jones\AppData\Local\IconCache.db
data
dropped
 malicious
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
data
dropped
 malicious
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
data
dropped
 malicious
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml
data
dropped
 malicious
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml
data
dropped
 malicious
C:\Users\jones\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg
JPEG image data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite
data
dropped
 malicious
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm
data
dropped
 malicious
C:\Users\jones\Local Settings\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db-shm.bgjs (copy)
data
dropped
 malicious
C:\Users\jones\Local Settings\IconCache.db.bgjs (copy)
data
dropped
 malicious
C:\Users\jones\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy)
data
dropped
 malicious
C:\Users\jones\_README.txt
ASCII text, with CRLF line terminators
dropped
 malicious
C:\_README.txt
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\BGHJEBKJEGHJKECAAKJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IJEHCGIJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KECFCGHIDHCAKEBFCFHCBFBKKE
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\SystemID\PersonalID.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\.curlrc
data
dropped
C:\Users\user\.curlrc.bgjs (copy)
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgjs (copy)
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgjs (copy)
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgjs (copy)
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgjs (copy)
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log
data
modified
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgjs (copy)
data
dropped
C:\Users\user\AppData\Local\.curlrc
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst
PostScript document text
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst
PostScript document text
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat
data
dropped
C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst
data
dropped
C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp
data
dropped
C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx
data
dropped
C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs
data
dropped
C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs
data
dropped
C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx
data
dropped
C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm
data
dropped
C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol
data
dropped
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp
data
dropped
C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
data
dropped
C:\Users\user\AppData\Local\IconCache.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log
data
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log
data
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log
data
dropped
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt
data
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log
Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170133v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170134v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170135v4.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170136v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170137v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170138v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170139v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170140v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170141v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170142v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180003v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180026v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180027v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180028v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180029v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180030v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180031v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180032v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180043v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180049v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180051v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180052v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180057v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180058v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180059v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180063v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180064v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180065v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180066v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180072v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180077v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180078v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180079v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180080v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180084v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180087v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180135v4.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180136v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180143v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180159v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180160v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180161v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180162v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180163v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180177v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180178v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180181v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180182v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180183v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180195v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180200v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180202v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220004v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220035v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule220036v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222015v6.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222042v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222043v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222049v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222100v7.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222101v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222102v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule222200v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224008v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224010v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224011v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224012v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224013v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224059v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224060v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224061v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224062v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224068v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224072v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224073v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224074v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224075v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224082v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224083v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224084v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224085v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224086v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224087v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224900v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224901v11.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224902v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224903v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224906v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule224910v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226000v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226003v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule226009v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule230161v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23068v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23070v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23120v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23122v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23123v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23124v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule23125v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240005v8.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240006v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240007v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240008v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240009v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240010v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240012v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240013v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240014v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240015v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240016v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240018v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240020v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240021v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240025v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240026v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240029v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240030v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240031v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240032v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240033v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240034v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240038v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240039v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241000v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241001v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241002v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270000v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270001v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270002v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270003v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270004v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270005v4.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270006v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270007v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270009v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270010v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270011v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270012v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270013v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270014v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270015v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270016v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270017v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270018v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270019v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule310000v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320001v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320002v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120616v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120617v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120618v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120619v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120620v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120621v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120622v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120623v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120624v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120625v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120626v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120627v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120628v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120629v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120630v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120631v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120632v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120633v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120634v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120635v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120636v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120637v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120638v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120639v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120640v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120641v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120642v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120643v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120644v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120645v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120646v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120647v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120648v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120649v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120650v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120651v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120652v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120653v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120654v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120655v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120656v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120657v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120658v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120659v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120660v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120661v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120662v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120663v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120664v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120665v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120666v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120667v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120668v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120669v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120670v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120671v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120672v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120673v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120674v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120675v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120676v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120677v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120678v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120679v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120680v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120681v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120682v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222015v6.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222042v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222043v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222049v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222100v7.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222101v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222102v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222200v5.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule224900v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule224901v11.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule224902v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230104v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230157v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230158v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230161v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230162v1.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230164v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230165v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230166v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230167v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230168v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230169v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230171v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230173v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230174v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule460008v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule460009v0.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700000v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule700001v2.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70002v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule70003v3.xml
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt
data
dropped
C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres
data
dropped
C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0325ABFA-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\get[1].htm
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V0100004.log
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log
data
dropped
C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal
SQLite Write-Ahead Log, version 14255047
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\UTD5SFEV\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\UTD5SFEV\trans[1].gif
GIF image data 4727
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\UTD5SFEV\trans[2].gif
GIF image data 26253 x 1189
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\XP05FTX1\th[1].svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\XP05FTX1\th[2].png
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\XP05FTX1\trans[1].gif
GIF image data 32284 x
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\XP05FTX1\trans[2].gif
GIF image data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{05ea5f90-4347-4a95-a7e3-40799835a752}\Apps.index
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3bc3f5b6-b1ab-46e4-a933-7d8002b0a491}\Apps.index
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9a386491-5394-47a0-a408-e4e3a9d60139}\Apps.index
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error
data
dropped
C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb
data
dropped
C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error
data
dropped
C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir10952_1826612563\f92dd30f-d70e-4c79-98e6-b827a8bb342f.tmp
Google Chrome extension, version 2111655171
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\10f5ef49-b826-4bae-a469-4fe1cdaa885f.tmp
Google Chrome extension, version 2745333763
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\polyfills.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\private-api.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\proxy.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\session.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\settings.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\sharepoint-module.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\splunkAllowedLogs.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\user-subscription.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\util.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\viewer-module-utils.js
data
dropped
C:\Users\user\AppData\Local\Temp\scoped_dir5952_991612011\CRX_INSTALL\sw_modules\viewer-module.js
data
dropped
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe:Zone.Identifier
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\bowsakkdestx.txt
data
dropped
C:\Users\user\AppData\Roaming\.curlrc
data
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav
data
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.png
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DBIQSSCSZX.png
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DRBXYKCKXO.mp3
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GLTYDMDUST.mp3
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GLTYDMDUST.pdf
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GYPUZXUUOF.jpg
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.png
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.mp3
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.pdf
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KGUOGFAKSS.png
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.jpg
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.docx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.xlsx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.docx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.jpg
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.xlsx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.docx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.docx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf
HIT archive data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.mp3
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.pdf
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.jpg
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.xlsx
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink
data
dropped
C:\Users\user\Application Data\.curlrc.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\CZQKSDDMWR.png.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\DBIQSSCSZX.png.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\DRBXYKCKXO.mp3.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\GLTYDMDUST.mp3.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\GLTYDMDUST.pdf.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\GYPUZXUUOF.jpg.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\HMPPSXQPQV.png.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.mp3.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.pdf.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\KGUOGFAKSS.png.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\LFOPODGVOH.jpg.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\LHEPQPGEWF.docx.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\LHEPQPGEWF.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\LIJDSFKJZG.docx.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.jpg.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\NYMMPCEIMA.docx.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.docx.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf.bgjs (copy)
HIT archive data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\VWDFPKGDUF.mp3.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.pdf.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\ZUYYDJDFVF.jpg.bgjs (copy)
data
dropped
C:\Users\user\Application Data\Microsoft\Windows\Recent\ZUYYDJDFVF.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\CZQKSDDMWR.png
data
dropped
C:\Users\user\Desktop\CZQKSDDMWR.png.bgjs (copy)
data
dropped
C:\Users\user\Desktop\GLTYDMDUST.mp3.bgjs (copy)
data
dropped
C:\Users\user\Desktop\GLTYDMDUST.pdf.bgjs (copy)
data
dropped
C:\Users\user\Desktop\HMPPSXQPQV.png
data
dropped
C:\Users\user\Desktop\HMPPSXQPQV.png.bgjs (copy)
data
dropped
C:\Users\user\Desktop\LFOPODGVOH.jpg
data
dropped
C:\Users\user\Desktop\LFOPODGVOH.jpg.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NWCXBPIUYI.jpg
data
dropped
C:\Users\user\Desktop\NWCXBPIUYI.jpg.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NWCXBPIUYI.xlsx
data
dropped
C:\Users\user\Desktop\NWCXBPIUYI.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA.docx
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA.docx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA.xlsx
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\GLTYDMDUST.pdf
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\GLTYDMDUST.pdf.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\HMPPSXQPQV.png
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\HMPPSXQPQV.png.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\LFOPODGVOH.jpg
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\LFOPODGVOH.jpg.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\NWCXBPIUYI.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\NYMMPCEIMA.docx
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\NYMMPCEIMA.docx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\VWDFPKGDUF.mp3
data
dropped
C:\Users\user\Desktop\NYMMPCEIMA\VWDFPKGDUF.mp3.bgjs (copy)
data
dropped
C:\Users\user\Desktop\QCOILOQIKC.docx
data
dropped
C:\Users\user\Desktop\QCOILOQIKC.docx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\CZQKSDDMWR.png
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\CZQKSDDMWR.png.bgjs (copy)
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\GLTYDMDUST.mp3
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\GLTYDMDUST.mp3.bgjs (copy)
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\NWCXBPIUYI.jpg
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\NWCXBPIUYI.jpg.bgjs (copy)
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\NYMMPCEIMA.xlsx
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\NYMMPCEIMA.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\QCOILOQIKC.docx
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\QCOILOQIKC.docx.bgjs (copy)
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\ZIPXYXWIOY.pdf
data
dropped
C:\Users\user\Desktop\QCOILOQIKC\ZIPXYXWIOY.pdf.bgjs (copy)
data
dropped
C:\Users\user\Desktop\VWDFPKGDUF.mp3
data
dropped
C:\Users\user\Desktop\VWDFPKGDUF.mp3.bgjs (copy)
data
dropped
C:\Users\user\Desktop\ZIPXYXWIOY.pdf
data
dropped
C:\Users\user\Desktop\ZIPXYXWIOY.pdf.bgjs (copy)
data
dropped
C:\Users\user\Documents\CZQKSDDMWR.png
data
dropped
C:\Users\user\Documents\CZQKSDDMWR.png.bgjs (copy)
data
dropped
C:\Users\user\Documents\GLTYDMDUST.mp3
data
dropped
C:\Users\user\Documents\GLTYDMDUST.mp3.bgjs (copy)
data
dropped
C:\Users\user\Documents\GLTYDMDUST.pdf
data
dropped
C:\Users\user\Documents\GLTYDMDUST.pdf.bgjs (copy)
data
dropped
C:\Users\user\Documents\HMPPSXQPQV.png
data
dropped
C:\Users\user\Documents\HMPPSXQPQV.png.bgjs (copy)
data
dropped
C:\Users\user\Documents\LFOPODGVOH.jpg
data
dropped
C:\Users\user\Documents\LFOPODGVOH.jpg.bgjs (copy)
data
dropped
C:\Users\user\Documents\NWCXBPIUYI.jpg
data
dropped
C:\Users\user\Documents\NWCXBPIUYI.jpg.bgjs (copy)
data
dropped
C:\Users\user\Documents\NWCXBPIUYI.xlsx
data
dropped
C:\Users\user\Documents\NWCXBPIUYI.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA.docx
data
dropped
C:\Users\user\Documents\NYMMPCEIMA.docx.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA.xlsx
data
dropped
C:\Users\user\Documents\NYMMPCEIMA.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\GLTYDMDUST.pdf
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\GLTYDMDUST.pdf.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\HMPPSXQPQV.png
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\HMPPSXQPQV.png.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\LFOPODGVOH.jpg
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\LFOPODGVOH.jpg.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\NWCXBPIUYI.xlsx
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\NWCXBPIUYI.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\NYMMPCEIMA.docx
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\NYMMPCEIMA.docx.bgjs (copy)
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\VWDFPKGDUF.mp3
data
dropped
C:\Users\user\Documents\NYMMPCEIMA\VWDFPKGDUF.mp3.bgjs (copy)
data
dropped
C:\Users\user\Documents\QCOILOQIKC.docx
data
dropped
C:\Users\user\Documents\QCOILOQIKC.docx.bgjs (copy)
data
dropped
C:\Users\user\Documents\QCOILOQIKC\CZQKSDDMWR.png
data
dropped
C:\Users\user\Documents\QCOILOQIKC\CZQKSDDMWR.png.bgjs (copy)
data
dropped
C:\Users\user\Documents\QCOILOQIKC\GLTYDMDUST.mp3
data
dropped
C:\Users\user\Documents\QCOILOQIKC\GLTYDMDUST.mp3.bgjs (copy)
data
dropped
C:\Users\user\Documents\QCOILOQIKC\NWCXBPIUYI.jpg
data
dropped
C:\Users\user\Documents\QCOILOQIKC\NWCXBPIUYI.jpg.bgjs (copy)
data
dropped
C:\Users\user\Documents\QCOILOQIKC\NYMMPCEIMA.xlsx
data
dropped
C:\Users\user\Documents\QCOILOQIKC\NYMMPCEIMA.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Documents\QCOILOQIKC\QCOILOQIKC.docx
data
dropped
C:\Users\user\Documents\QCOILOQIKC\QCOILOQIKC.docx.bgjs (copy)
data
dropped
C:\Users\user\Documents\QCOILOQIKC\ZIPXYXWIOY.pdf
data
dropped
C:\Users\user\Documents\QCOILOQIKC\ZIPXYXWIOY.pdf.bgjs (copy)
data
dropped
C:\Users\user\Documents\VWDFPKGDUF.mp3
data
dropped
C:\Users\user\Documents\VWDFPKGDUF.mp3.bgjs (copy)
data
dropped
C:\Users\user\Documents\ZIPXYXWIOY.pdf
data
dropped
C:\Users\user\Documents\ZIPXYXWIOY.pdf.bgjs (copy)
data
dropped
C:\Users\user\Downloads\CZQKSDDMWR.png
data
dropped
C:\Users\user\Downloads\CZQKSDDMWR.png.bgjs (copy)
data
dropped
C:\Users\user\Downloads\GLTYDMDUST.mp3
data
dropped
C:\Users\user\Downloads\GLTYDMDUST.mp3.bgjs (copy)
data
dropped
C:\Users\user\Downloads\GLTYDMDUST.pdf
data
dropped
C:\Users\user\Downloads\GLTYDMDUST.pdf.bgjs (copy)
data
dropped
C:\Users\user\Downloads\HMPPSXQPQV.png
data
dropped
C:\Users\user\Downloads\HMPPSXQPQV.png.bgjs (copy)
data
dropped
C:\Users\user\Downloads\LFOPODGVOH.jpg
data
dropped
C:\Users\user\Downloads\LFOPODGVOH.jpg.bgjs (copy)
data
dropped
C:\Users\user\Downloads\NWCXBPIUYI.jpg
data
dropped
C:\Users\user\Downloads\NWCXBPIUYI.jpg.bgjs (copy)
data
dropped
C:\Users\user\Downloads\NWCXBPIUYI.xlsx
data
dropped
C:\Users\user\Downloads\NWCXBPIUYI.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Downloads\NYMMPCEIMA.docx
data
dropped
C:\Users\user\Downloads\NYMMPCEIMA.docx.bgjs (copy)
data
dropped
C:\Users\user\Downloads\NYMMPCEIMA.xlsx
data
dropped
C:\Users\user\Downloads\NYMMPCEIMA.xlsx.bgjs (copy)
data
dropped
C:\Users\user\Downloads\QCOILOQIKC.docx
data
dropped
C:\Users\user\Downloads\QCOILOQIKC.docx.bgjs (copy)
data
dropped
C:\Users\user\Downloads\VWDFPKGDUF.mp3
data
dropped
C:\Users\user\Downloads\VWDFPKGDUF.mp3.bgjs (copy)
data
dropped
C:\Users\user\Downloads\ZIPXYXWIOY.pdf
data
dropped
C:\Users\user\Downloads\ZIPXYXWIOY.pdf.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Amazon.url
data
dropped
C:\Users\user\Favorites\Amazon.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Bing.url
data
dropped
C:\Users\user\Favorites\Bing.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Facebook.url
data
dropped
C:\Users\user\Favorites\Facebook.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Google.url
data
dropped
C:\Users\user\Favorites\Google.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Live.url
data
dropped
C:\Users\user\Favorites\Live.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\NYTimes.url
data
dropped
C:\Users\user\Favorites\NYTimes.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Reddit.url
data
dropped
C:\Users\user\Favorites\Reddit.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Twitter.url
data
dropped
C:\Users\user\Favorites\Twitter.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Wikipedia.url
data
dropped
C:\Users\user\Favorites\Wikipedia.url.bgjs (copy)
data
dropped
C:\Users\user\Favorites\Youtube.url
data
dropped
C:\Users\user\Favorites\Youtube.url.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\.curlrc.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgjs (copy)
PostScript document text
dropped
C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgjs (copy)
PostScript document text
dropped
C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\IconCache.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.bgjs (copy)
Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
dropped
C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Caches\{0325ABFA-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V0100004.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal.bgjs (copy)
SQLite Write-Ahead Log, version 14255047
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite.bgjs (copy)
data
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\user\Local Settings\Temp\scoped_dir10952_1826612563\f92dd30f-d70e-4c79-98e6-b827a8bb342f.tmp.bgjs (copy)
Google Chrome extension, version 2111655171
dropped
C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms
data
dropped
C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.bgjs (copy)
data
dropped
C:\Users\user\SendTo\Bluetooth File Transfer.LNK.bgjs (copy)
data
dropped
C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.bgjs (copy)
data
dropped
C:\Users\jones\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst
PostScript document text
dropped
C:\Users\jones\AppData\Local\Adobe\Color\ACECache11.lst
data
dropped
C:\Users\jones\AppData\Local\Comms\UnistoreDB\USS.jcp
data
dropped
C:\Users\jones\AppData\Local\Comms\UnistoreDB\USS.jtx
data
dropped
C:\Users\jones\AppData\Local\Comms\UnistoreDB\USSres00001.jrs
data
dropped
C:\Users\jones\AppData\Local\Comms\UnistoreDB\USSres00002.jrs
data
dropped
C:\Users\jones\AppData\Local\Comms\UnistoreDB\USStmp.jtx
data
dropped
C:\Users\jones\AppData\Local\Comms\UnistoreDB\store.jfm
data
dropped
C:\Users\jones\AppData\Local\Comms\UnistoreDB\store.vol
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651BFFE6-228.pma
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651BFFFF-BD8.pma
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651C0414-22F8.pma
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D225D-18BC.pma
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D2262-1A18.pma
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
data
dropped
C:\Users\jones\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651BFF76-DF0.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C00B3-378.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C00B3-67C.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C020C-1B28.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C020C-B60.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C0537-1BBC.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651C0537-1BC0.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D22E2-1DAC.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D22E2-A84.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D23AD-1560.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D23AD-F98.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D2470-1A5C.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651D2470-6D0.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E5F5D-13E0.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E5F5D-DE4.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E630F-1A04.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E630F-1A08.pma
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
data
dropped
C:\Users\jones\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json
data
dropped
C:\Users\jones\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_35.ttf
data
dropped
C:\Users\jones\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Internet Explorer\brndlog.txt
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log
Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
dropped
C:\Users\jones\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyEventActivityStats.json
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyHistoryStats.json
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120100v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120119v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120402v21.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120600v4.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120608v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule120609v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224900v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224901v11.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule224902v2.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule226009v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230104v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230157v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230158v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230162v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230164v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230165v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230166v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230167v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230168v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230169v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230171v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230173v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230174v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230200v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700000v2.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700001v2.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700050v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700051v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700100v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700101v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700150v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700151v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700200v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700201v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700250v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700251v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700300v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700301v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700350v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700351v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700400v2.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700401v2.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700450v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700451v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700500v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700501v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700550v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700551v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700600v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700601v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700650v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700651v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700700v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700701v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700750v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700751v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700850v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700851v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700900v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700901v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700950v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700951v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701050v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701051v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701100v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701101v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701150v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701151v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml
data
dropped
C:\Users\jones\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
data
dropped
C:\Users\jones\AppData\Local\Microsoft\Windows\UsrClass.dat
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\AppData\Local\Microsoft\fluency\lm\en-GB\.config
data
dropped
C:\Users\jones\AppData\Local\Microsoft\fluency\lm\en-GB\dynamic.lm
data
dropped
C:\Users\jones\AppData\Local\Microsoft\fluency\lm\en-GB\learned.json
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\d00655d2aa12ff6d.automaticDestinations-ms
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\fb3b0dbfee58fac8.automaticDestinations-ms
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7e4dca80246863e3.customDestinations-ms
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f01b4d95cf55d32a.customDestinations-ms
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK
data
dropped
C:\Users\jones\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json
data
dropped
C:\Users\jones\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json
data
dropped
C:\Users\jones\AppData\Roaming\Skype\RootTools\roottools.conf
data
dropped
C:\Users\jones\Application Data\Skype\RootTools\roottools.conf.bgjs (copy)
data
dropped
C:\Users\jones\Favorites\Bing.url
data
dropped
C:\Users\jones\Favorites\Bing.url.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Adobe\Color\ACECache11.lst.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Comms\UnistoreDB\USS.jcp.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Comms\UnistoreDB\USS.jtx.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Comms\UnistoreDB\USSres00001.jrs.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Comms\UnistoreDB\USSres00002.jrs.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Comms\UnistoreDB\USStmp.jtx.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Comms\UnistoreDB\store.jfm.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Comms\UnistoreDB\store.vol.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\ConnectedDevicesPlatform\L.jones\ActivitiesCache.db.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Microsoft\GameDVR\KnownGameList.bin.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Microsoft\Internet Explorer\brndlog.txt.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.bgjs (copy)
Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
dropped
C:\Users\jones\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgjs (copy)
data
dropped
C:\Users\jones\Local Settings\Microsoft\Windows\UsrClass.dat.LOG1.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\Local Settings\Microsoft\Windows\UsrClass.dat.LOG2.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\Local Settings\Microsoft\Windows\UsrClass.dat.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\NTUSER.DAT
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\NTUSER.DAT.bgjs (copy)
MS Windows registry file, NT/2000 or above
dropped
C:\Users\jones\Recent\AutomaticDestinations\d00655d2aa12ff6d.automaticDestinations-ms.bgjs (copy)
data
dropped
C:\Users\jones\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.bgjs (copy)
data
dropped
C:\Users\jones\Recent\AutomaticDestinations\fb3b0dbfee58fac8.automaticDestinations-ms.bgjs (copy)
data
dropped
C:\Users\jones\Recent\CustomDestinations\7e4dca80246863e3.customDestinations-ms.bgjs (copy)
data
dropped
C:\Users\jones\Recent\CustomDestinations\f01b4d95cf55d32a.customDestinations-ms.bgjs (copy)
data
dropped
C:\Users\jones\Recent\CustomDestinations\f18460fded109990.customDestinations-ms.bgjs (copy)
data
dropped
C:\Users\jones\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms
data
dropped
C:\Users\jones\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.bgjs (copy)
data
dropped
C:\Users\jones\SendTo\Bluetooth File Transfer.LNK.bgjs (copy)
data
dropped
C:\Users\jones\SendTo\Desktop (create shortcut).DeskLink.bgjs (copy)
data
dropped
There are 1368 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\qJKiVKZdFk.exe
"C:\Users\user\Desktop\qJKiVKZdFk.exe"
 malicious
C:\Users\user\Desktop\qJKiVKZdFk.exe
"C:\Users\user\Desktop\qJKiVKZdFk.exe"
 malicious
C:\Users\user\Desktop\qJKiVKZdFk.exe
"C:\Users\user\Desktop\qJKiVKZdFk.exe" --Admin IsNotAutoStart IsNotTask
 malicious
C:\Users\user\Desktop\qJKiVKZdFk.exe
"C:\Users\user\Desktop\qJKiVKZdFk.exe" --Admin IsNotAutoStart IsNotTask
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe --Task
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe --Task
 malicious
C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build2.exe
"C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build2.exe"
malicious
C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build2.exe
"C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build2.exe"
malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
"C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe" --AutoStart
 malicious
C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build3.exe
"C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build3.exe"
malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
"C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe" --AutoStart
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
"C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe" --AutoStart
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
"C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe" --AutoStart
 malicious
C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build3.exe
"C:\Users\user\AppData\Local\225a7e21-4654-4142-adcf-9fa08e829768\build3.exe"
malicious
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe --Task
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe --Task
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe --Task
 malicious
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe
C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed\qJKiVKZdFk.exe --Task
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
 malicious
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\user\AppData\Local\adc5c568-a82d-462c-a723-6011683251ed" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 17 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://cajgtus.com/test1/get.php
malicious
http://cajgtus.com/test1/get.php?pid=3C8DAB0A318E3BBE55D6418C454BF200&first=true
189.232.19.193
 malicious
http://cajgtus.com/test1/get.php?pid=3C8DAB0A318E3BBE55D6418C454BF200
189.232.19.193
 malicious
http://sdfjhuz.com/dl/build2.exe
211.181.24.132
 malicious
http://cajgtus.com/files/1/build3.exe
189.232.19.193
 malicious
https://t.me/irfailAt
unknown
http://cajgtus.com/files/1/build3.exe$run
unknown
https://assets.activity.windows.com/v1/assets
unknown
https://github.com/react-native-community/react-native-netinfo
unknown
https://api.2ip.ua/
unknown
http://cajgtus.com/files/1/build3.exe$runh
unknown
http://cajgtus.com/test1/get.phpDh
unknown
https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
unknown
http://sdfjhuz.com/dl/build2.exeKf
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429
unknown
http://www.amazon.com/
unknown
http://sdfjhuz.com/dl/build2.exe$run
unknown
http://cajgtus.com/files/1/build3.exe$runo
unknown
http://cajgtus.com/files/1/build3.exerun
unknown
https://steamcommunity.com/profiles/76561199673019888
23.65.44.84
http://www.twitter.com/
unknown
https://api.2ip.ua/geo.json
104.21.65.24
https://clients3.google.com/generate_204
unknown
http://sdfjhuz.com/dl/build2.exerun421f
unknown
http://www.openssl.org/support/faq.html
unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
unknown
http://www.youtube.com/
unknown
https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
unknown
https://api.2ip.ua/Hb
unknown
https://api.2ip.ua/geo.jsonL
unknown
http://www.wikipedia.com/
unknown
https://assets.activity.windows.com
unknown
https://95.217.9.149/sqln.dll
95.217.9.149
https://api.2ip.ua/geo.jsonfq
unknown
https://t.me/irfail
unknown
https://activity.windows.com
unknown
https://api.2ip.ua/:b
unknown
https://95.217.9.149/
95.217.9.149
https://assets.activity.windows.com/v1/assets/$batch
unknown
http://www.google.com/
unknown
There are 30 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
sdfjhuz.com
211.181.24.132
 malicious
cajgtus.com
189.232.19.193
 malicious
steamcommunity.com
23.65.44.84
api.2ip.ua
104.21.65.24

IPs

IP
Domain
Country
Malicious
189.232.19.193
cajgtus.com
Mexico
malicious
211.181.24.132
sdfjhuz.com
Korea Republic of
malicious
95.217.9.149
unknown
Germany
104.21.65.24
api.2ip.ua
United States
23.65.44.84
steamcommunity.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SysHelper
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
SysHelper

Memdumps

Base Address
Regiontype
Protect
Malicious
3540000
direct allocation
page execute and read and write
 malicious
5E00000
direct allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
5DC0000
direct allocation
page execute and read and write
 malicious
980000
direct allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
5DC0000
direct allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
5DE0000
direct allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
890000
direct allocation
page execute and read and write
 malicious
5E80000
direct allocation
page execute and read and write
 malicious
890000
direct allocation
page execute and read and write
 malicious
656000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
5E70000
direct allocation
page execute and read and write
 malicious
5E60000
direct allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
41BE000
stack
page read and write
580000
heap
page read and write
3BFC000
heap
page read and write
9AB000
heap
page read and write
8BB000
heap
page read and write
2FAE000
heap
page read and write
97E0000
direct allocation
page read and write
2A6E000
stack
page read and write
958000
heap
page read and write
9BD000
heap
page read and write
411000
unkown
page readonly
2E70000
remote allocation
page read and write
97E0000
direct allocation
page read and write
948000
heap
page read and write
823000
heap
page read and write
2E70000
remote allocation
page read and write
F2F000
stack
page read and write
2FA2000
heap
page read and write
8BA000
heap
page read and write
7E9000
unkown
page readonly
3280000
heap
page read and write
97E0000
direct allocation
page read and write
33E3000
heap
page read and write
353F000
heap
page read and write
529000
remote allocation
page execute and read and write
3586000
heap
page read and write
3459000
heap
page read and write
989000
heap
page read and write
28FE000
stack
page read and write
268F000
stack
page read and write
400000
unkown
page readonly
33AD000
heap
page read and write
316C000
heap
page read and write
650000
heap
page read and write
41D0000
heap
page read and write
57E000
stack
page read and write
1F2E000
stack
page read and write
3189000
heap
page read and write
3BE3000
heap
page read and write
94C000
heap
page read and write
9C000
stack
page read and write
401000
unkown
page execute read
19D000
stack
page read and write
2F76000
heap
page read and write
5FE000
stack
page read and write
3305000
heap
page read and write
9C000
stack
page read and write
3D34000
heap
page read and write
411000
unkown
page readonly
442F000
stack
page read and write
310E000
heap
page read and write
418000
unkown
page write copy
31AA000
heap
page read and write
33F8000
heap
page read and write
401000
unkown
page execute read
9AD000
heap
page execute and read and write
363C000
heap
page read and write
35D4000
heap
page read and write
790000
heap
page read and write
4100000
heap
page read and write
36F1000
heap
page read and write
3150000
heap
page read and write
62E000
stack
page read and write
3BB6000
heap
page read and write
35A4000
heap
page read and write
4B2000
unkown
page read and write
8DD000
heap
page read and write
36F0000
heap
page read and write
3576000
heap
page read and write
435000
unkown
page execute read
97E0000
direct allocation
page read and write
860000
heap
page read and write
32C4000
heap
page read and write
2FB1000
heap
page read and write
401000
unkown
page execute read
3261000
heap
page read and write
2F94000
heap
page read and write
410000
heap
page read and write
DDDF000
stack
page read and write
401000
unkown
page execute read
3B11000
heap
page read and write
35DF000
heap
page read and write
3430000
direct allocation
page read and write
1F0000
heap
page read and write
420E000
stack
page read and write
2E9E000
stack
page read and write
1E94F000
direct allocation
page readonly
605000
heap
page read and write
597000
heap
page read and write
6A6000
heap
page read and write
30B1000
heap
page read and write
1E700000
direct allocation
page execute and read and write
32C4000
heap
page read and write
14EEE000
stack
page read and write
3D54000
heap
page read and write
3430000
direct allocation
page read and write
7E6000
heap
page read and write
83E000
stack
page read and write
6D2000
heap
page read and write
90F000
heap
page read and write
3273000
heap
page read and write
413E000
stack
page read and write
3198000
heap
page read and write
90E000
heap
page read and write
3640000
heap
page read and write
3CA0000
heap
page read and write
97E0000
direct allocation
page read and write
400000
unkown
page readonly
8E9000
heap
page read and write
3820000
heap
page read and write
97E0000
direct allocation
page read and write
72F000
stack
page read and write
1F0000
heap
page read and write
6B9000
heap
page read and write
2F8C000
heap
page read and write
A8F000
stack
page read and write
3BA5000
heap
page read and write
3380000
heap
page read and write
3374000
heap
page read and write
1F0000
heap
page read and write
331F000
heap
page read and write
2BBE000
stack
page read and write
314A000
heap
page read and write
3176000
heap
page read and write
33E7000
heap
page read and write
3390000
heap
page read and write
560000
heap
page read and write
3148000
heap
page read and write
36EE000
heap
page read and write
36F1000
heap
page read and write
840000
heap
page read and write
32C5000
heap
page read and write
9D2000
heap
page read and write
35DF000
heap
page read and write
435000
unkown
page execute read
3626000
heap
page read and write
435000
unkown
page execute read
3170000
heap
page read and write
B9F000
stack
page read and write
32C4000
heap
page read and write
338F000
heap
page read and write
8CD000
heap
page read and write
607000
heap
page read and write
3856000
heap
page read and write
3430000
direct allocation
page read and write
338D000
heap
page read and write
41A000
unkown
page read and write
4550000
heap
page read and write
3586000
heap
page read and write
3184000
heap
page read and write
3BA5000
heap
page read and write
3271000
heap
page read and write
3186000
heap
page read and write
97E0000
direct allocation
page read and write
97E0000
direct allocation
page read and write
40A0000
unkown
page readonly
6F2000
heap
page read and write
3298000
heap
page read and write
818000
heap
page read and write
605000
heap
page read and write
318D000
heap
page read and write
97FE000
direct allocation
page read and write
34EF000
heap
page read and write
3820000
heap
page read and write
33C1000
heap
page read and write
39F9000
heap
page read and write
33F1000
heap
page read and write
C2F000
stack
page read and write
291E000
stack
page read and write
33E7000
heap
page read and write
33B0000
heap
page read and write
65E000
stack
page read and write
95F000
heap
page read and write
400000
unkown
page readonly
97E0000
direct allocation
page read and write
3C1F000
heap
page read and write
3586000
heap
page read and write
951000
heap
page read and write
3470000
heap
page read and write
3147000
heap
page read and write
4300000
direct allocation
page read and write
363B000
heap
page read and write
3342000
heap
page read and write
3409000
heap
page read and write
46C0000
heap
page read and write
4210000
heap
page read and write
9D0000
heap
page read and write
36E1000
heap
page read and write
41B000
unkown
page write copy
3285000
heap
page read and write
261F000
stack
page read and write
900000
heap
page read and write
19B000
stack
page read and write
32E9000
heap
page read and write
902000
heap
page read and write
986000
heap
page read and write
3261000
heap
page read and write
40B0000
heap
page read and write
400000
unkown
page readonly
823000
heap
page read and write
3196000
heap
page read and write
3273000
heap
page read and write
33E5000
heap
page read and write
3370000
heap
page read and write
83B000
heap
page read and write
7E9000
unkown
page readonly
6E4000
heap
page read and write
32F3000
heap
page read and write
279F000
stack
page read and write
94D000
heap
page read and write
52B000
remote allocation
page execute and read and write
88E000
stack
page read and write
335B000
heap
page read and write
35CF000
heap
page read and write
346A000
heap
page read and write
32D9000
heap
page read and write
41B000
unkown
page write copy
401000
unkown
page execute read
3380000
heap
page read and write
3741000
heap
page read and write
3BFA000
heap
page read and write
4B2000
unkown
page read and write
32FC000
heap
page read and write
8B3000
heap
page read and write
3533000
heap
page read and write
3BFA000
heap
page read and write
2FB0000
remote allocation
page read and write
86A000
heap
page read and write
45EF000
stack
page read and write
2CFE000
stack
page read and write
3771000
heap
page read and write
9B000
stack
page read and write
697000
heap
page read and write
36D2000
heap
page read and write
40E0000
heap
page read and write
2A10000
heap
page read and write
24E0000
heap
page read and write
31AD000
heap
page read and write
400000
unkown
page readonly
1E866000
direct allocation
page execute read
40C8000
heap
page read and write
618000
heap
page read and write
33A9000
heap
page read and write
37C9000
heap
page read and write
32E7000
heap
page read and write
605000
heap
page read and write
355B000
heap
page read and write
3BFF000
heap
page read and write
92B000
heap
page read and write
33F5000
heap
page read and write
3820000
heap
page read and write
400000
unkown
page readonly
3176000
heap
page read and write
401000
unkown
page execute read
262F000
stack
page read and write
1F0000
heap
page read and write
313F000
heap
page read and write
6F3000
heap
page read and write
3335000
heap
page read and write
401000
unkown
page execute read
32C4000
heap
page read and write
401000
unkown
page execute read
317B000
heap
page read and write
3277000
heap
page read and write
193000
stack
page read and write
40A0000
unkown
page readonly
33D9000
heap
page read and write
36B1000
heap
page read and write
34EF000
heap
page read and write
8B0000
heap
page read and write
197000
stack
page read and write
97E0000
direct allocation
page read and write
401000
unkown
page execute read
6F8000
heap
page read and write
447000
unkown
page read and write
36F1000
heap
page read and write
3489000
heap
page read and write
410000
heap
page read and write
9DF000
stack
page read and write
2DEE000
stack
page read and write
3452000
heap
page read and write
3771000
heap
page read and write
411000
unkown
page readonly
1290F000
stack
page read and write
3430000
direct allocation
page read and write
75E000
stack
page read and write
279E000
stack
page read and write
401000
unkown
page execute read
3287000
heap
page read and write
316E000
heap
page read and write
4160000
heap
page read and write
971000
heap
page execute and read and write
1E0000
heap
page read and write
97E0000
direct allocation
page read and write
3800000
heap
page read and write
97E0000
direct allocation
page read and write
35A7000
heap
page read and write
9C0000
heap
page read and write
3399000
heap
page read and write
23EE000
stack
page read and write
314A000
heap
page read and write
39B1000
heap
page read and write
32F9000
heap
page read and write
2E5E000
stack
page read and write
36C2000
heap
page read and write
411000
unkown
page readonly
52FF000
stack
page read and write
1E7000
heap
page read and write
401000
unkown
page execute read
97E0000
direct allocation
page read and write
2A6D000
stack
page read and write
64E000
stack
page read and write
438000
unkown
page write copy
375A000
heap
page read and write
44F0000
direct allocation
page read and write
31B8000
direct allocation
page read and write
5B7000
heap
page read and write
3584000
heap
page read and write
970000
heap
page read and write
677000
heap
page read and write
97E0000
direct allocation
page read and write
3389000
heap
page read and write
41A000
unkown
page write copy
32C5000
heap
page read and write
19C000
stack
page read and write
312B000
heap
page read and write
2F80000
heap
page read and write
401000
unkown
page execute read
32C4000
heap
page read and write
A30000
heap
page read and write
32C4000
heap
page read and write
3BFA000
heap
page read and write
763000
heap
page read and write
3280000
heap
page read and write
40A0000
unkown
page readonly
349C000
heap
page read and write
444C000
heap
page execute and read and write
3A6F000
heap
page read and write
97E0000
direct allocation
page read and write
315F000
heap
page read and write
97E0000
direct allocation
page read and write
3290000
heap
page read and write
3154000
heap
page read and write
3335000
heap
page read and write
2E5E000
stack
page read and write
362B000
heap
page read and write
359B000
heap
page read and write
3C1F000
heap
page read and write
401000
unkown
page execute read
41F0000
heap
page read and write
2E70000
remote allocation
page read and write
32A6000
heap
page read and write
3BFF000
heap
page read and write
90B000
heap
page read and write
3B41000
heap
page read and write
3291000
heap
page read and write
420000
unkown
page write copy
420000
unkown
page write copy
97E8000
direct allocation
page read and write
90F000
heap
page read and write
420000
unkown
page write copy
3BB6000
heap
page read and write
2FB0000
remote allocation
page read and write
97E0000
direct allocation
page read and write
3800000
heap
page read and write
3D13000
heap
page read and write
6010000
heap
page read and write
4B2000
unkown
page read and write
87E000
stack
page read and write
401000
unkown
page execute read
3586000
heap
page read and write
C9F000
stack
page read and write
8A3000
heap
page read and write
19D000
stack
page read and write
316C000
heap
page read and write
401000
unkown
page execute read
3626000
heap
page read and write
1E90F000
direct allocation
page readonly
2A20000
heap
page read and write
52B000
remote allocation
page execute and read and write
317D000
heap
page read and write
32E7000
heap
page read and write
3BFF000
heap
page read and write
41B000
unkown
page write copy
4630000
heap
page read and write
2FB0000
heap
page read and write
41A000
unkown
page read and write
434000
remote allocation
page execute and read and write
33E7000
heap
page read and write
971000
heap
page read and write
2E70000
remote allocation
page read and write
97E0000
direct allocation
page read and write
3C6A000
heap
page read and write
529000
remote allocation
page execute and read and write
97E0000
direct allocation
page read and write
400000
unkown
page readonly
31EC000
stack
page read and write
409E000
unkown
page read and write
440F000
stack
page read and write
8BE000
heap
page read and write
19E000
stack
page read and write
905000
heap
page read and write
33C5000
heap
page read and write
2FB0000
remote allocation
page read and write
27DE000
stack
page read and write
1BF90000
heap
page read and write
438000
unkown
page write copy
3186000
heap
page read and write
910000
heap
page read and write
3148000
heap
page read and write
3C83000
heap
page read and write
3604000
heap
page read and write
9C000
stack
page read and write
400000
unkown
page readonly
6B3000
heap
page read and write
3196000
heap
page read and write
7E6000
unkown
page read and write
97B000
heap
page read and write
3384000
heap
page read and write
41E000
unkown
page write copy
41C0000
heap
page read and write
317B000
heap
page read and write
2FB0000
heap
page read and write
97E0000
direct allocation
page read and write
3856000
heap
page read and write
3824000
heap
page read and write
97E0000
direct allocation
page read and write
19A00000
remote allocation
page read and write
4310000
heap
page read and write
1E94A000
direct allocation
page readonly
3BB6000
heap
page read and write
3626000
heap
page read and write
411000
unkown
page readonly
6B0000
heap
page read and write
8F2000
heap
page read and write
1AD0000
heap
page read and write
420000
unkown
page write copy
202F000
stack
page read and write
2E70000
heap
page read and write
B85F000
stack
page read and write
590000
heap
page read and write
400000
unkown
page readonly
97E0000
direct allocation
page read and write
97E0000
direct allocation
page read and write
2F5F000
stack
page read and write
932000
heap
page read and write
3344000
heap
page read and write
317D000
heap
page read and write
289F000
stack
page read and write
312B000
heap
page read and write
31AD000
heap
page read and write
318F000
heap
page read and write
37A2000
heap
page read and write
33D9000
heap
page read and write
3BE0000
heap
page read and write
35EF000
heap
page read and write
20E59000
heap
page read and write
3191000
heap
page read and write
32C4000
heap
page read and write
400000
unkown
page readonly
355B000
heap
page read and write
650000
heap
page read and write
5D7000
heap
page read and write
9B000
stack
page read and write
676000
heap
page read and write
3313000
heap
page read and write
1AAE000
stack
page read and write
88F000
stack
page read and write
3452000
heap
page read and write
6E0000
heap
page read and write
97E0000
direct allocation
page read and write
3100000
heap
page read and write
609000
heap
page read and write
356F000
heap
page read and write
401000
unkown
page execute read
2FB0000
remote allocation
page read and write
1E0000
heap
page read and write
97E0000
direct allocation
page read and write
2460000
heap
page read and write
39E9000
heap
page read and write
37B1000
heap
page read and write
A1F000
stack
page read and write
97E0000
direct allocation
page read and write
6BD000
heap
page read and write
40A0000
unkown
page readonly
6F8000
heap
page read and write
6FA000
heap
page read and write
4B2000
unkown
page read and write
3146000
heap
page read and write
1F0000
heap
page read and write
1E6BE000
stack
page read and write
40A0000
unkown
page readonly
400000
unkown
page readonly
32E0000
heap
page read and write
40A0000
unkown
page readonly
2DEE000
stack
page read and write
193000
stack
page read and write
958000
heap
page read and write
33B0000
heap
page read and write
94A000
heap
page read and write
352B000
heap
page read and write
7F0000
heap
page read and write
35E0000
heap
page read and write
1D0000
heap
page read and write
41A000
unkown
page write copy
401000
unkown
page execute read
2F70000
heap
page read and write
4488000
heap
page execute and read and write
33A9000
heap
page read and write
35D9000
heap
page read and write
97E0000
direct allocation
page read and write
3430000
direct allocation
page read and write
3430000
direct allocation
page read and write
2FB0000
remote allocation
page read and write
3148000
heap
page read and write
830000
heap
page read and write
9B000
stack
page read and write
3187000
heap
page read and write
313A000
heap
page read and write
360D000
heap
page read and write
1D9F000
stack
page read and write
33A9000
heap
page read and write
3BFC000
heap
page read and write
3269000
heap
page read and write
376A000
heap
page read and write
5BE000
stack
page read and write
33B0000
heap
page read and write
33F1000
heap
page read and write
20DB2000
heap
page read and write
3CEF000
heap
page read and write
97E0000
direct allocation
page read and write
33F9000
heap
page read and write
32C4000
heap
page read and write
420000
unkown
page write copy
1E52D000
stack
page read and write
7F0000
heap
page read and write
3313000
heap
page read and write
32C4000
heap
page read and write
730000
heap
page read and write
335B000
heap
page read and write
9B000
stack
page read and write
3344000
heap
page read and write
37D8000
heap
page read and write
41FE000
stack
page read and write
19C000
stack
page read and write
3770000
heap
page read and write
86A000
heap
page read and write
337B000
heap
page read and write
3800000
heap
page read and write
3452000
heap
page read and write
345D000
heap
page read and write
1E90D000
direct allocation
page execute read
3185000
heap
page read and write
420000
unkown
page write copy
8CE000
heap
page read and write
97E0000
direct allocation
page read and write
52B000
remote allocation
page execute and read and write
316D000
heap
page read and write
2450000
direct allocation
page read and write
275F000
stack
page read and write
438000
unkown
page write copy
770000
heap
page read and write
316B000
heap
page read and write
2F70000
heap
page read and write
41A000
unkown
page read and write
3452000
heap
page read and write
9D7000
heap
page read and write
1E660000
trusted library allocation
page read and write
41B000
unkown
page write copy
3428000
heap
page read and write
64E000
stack
page read and write
97D000
heap
page read and write
99E000
heap
page read and write
3428000
heap
page read and write
6B7000
heap
page read and write
2FB0000
remote allocation
page read and write
3820000
heap
page read and write
3D1E000
heap
page read and write
353F000
heap
page read and write
1F0000
heap
page read and write
3342000
heap
page read and write
6E2000
heap
page read and write
314C000
heap
page read and write
1F0000
heap
page read and write
8C2000
heap
page read and write
92B000
heap
page read and write
41A000
unkown
page write copy
1F0000
heap
page read and write
1F0000
heap
page read and write
35A7000
heap
page read and write
332B000
heap
page read and write
290E000
stack
page read and write
9B000
stack
page read and write
915000
heap
page read and write
8F8000
heap
page read and write
35BE000
stack
page read and write
357F000
heap
page read and write
31B0000
direct allocation
page read and write
3189000
heap
page read and write
20C54000
heap
page read and write
670000
heap
page read and write
290ED000
stack
page read and write
3331000
heap
page read and write
91A000
heap
page read and write
3824000
heap
page read and write
3D1E000
heap
page read and write
92B000
heap
page read and write
327A000
heap
page read and write
3430000
direct allocation
page read and write
19E000
stack
page read and write
401000
unkown
page execute read
957000
heap
page read and write
357F000
heap
page read and write
3155000
heap
page read and write
36AD000
heap
page read and write
3712000
heap
page read and write
36EA000
heap
page read and write
19B000
stack
page read and write
8B3000
heap
page read and write
1E0000
heap
page read and write
1E94D000
direct allocation
page readonly
71E000
stack
page read and write
960000
heap
page read and write
3792000
heap
page read and write
40C0000
heap
page read and write
8B8000
heap
page read and write
3626000
heap
page read and write
411000
unkown
page readonly
2E60000
remote allocation
page read and write
29FF000
stack
page read and write
32B0000
heap
page read and write
31A6000
heap
page read and write
4C7000
heap
page read and write
35D4000
heap
page read and write
411000
unkown
page readonly
438000
unkown
page write copy
4B2000
unkown
page read and write
1F0000
heap
page read and write
78F000
stack
page read and write
2A10000
heap
page read and write
28FE000
stack
page read and write
3335000
heap
page read and write
3147000
heap
page read and write
798000
heap
page read and write
6AE000
stack
page read and write
5F6000
heap
page read and write
3AD1000
heap
page read and write
6EDA1000
unkown
page execute read
279E000
stack
page read and write
440F000
stack
page read and write
810000
heap
page read and write
31AD000
heap
page read and write
400000
unkown
page readonly
32EA000
heap
page read and write
41A000
unkown
page write copy
328C000
heap
page read and write
7E9000
unkown
page readonly
30D0000
heap
page read and write
3430000
direct allocation
page read and write
2B62E000
stack
page read and write
41A000
unkown
page write copy
19C000
stack
page read and write
438000
unkown
page write copy
2E70000
heap
page read and write
57E000
stack
page read and write
19A00000
remote allocation
page read and write
3C23000
heap
page read and write
4140000
heap
page read and write
3D16000
heap
page read and write
28DF000
stack
page read and write
9C2000
heap
page read and write
3290000
heap
page read and write
352B000
heap
page read and write
3B88000
heap
page read and write
326E000
heap
page read and write
97E0000
direct allocation
page read and write
25A0000
heap
page read and write
6B7000
heap
page read and write
19E000
stack
page read and write
90A000
heap
page read and write
313D000
heap
page read and write
9AB000
heap
page read and write
8DD000
heap
page read and write
3148000
heap
page read and write
2B6D000
stack
page read and write
8C8000
heap
page read and write
7E9000
unkown
page readonly
40A0000
unkown
page readonly
7E6000
unkown
page read and write
86B000
heap
page read and write
20E5B000
heap
page read and write
9C5000
heap
page read and write
2E71000
heap
page read and write
3360000
heap
page read and write
349C000
heap
page read and write
317E000
heap
page read and write
3430000
direct allocation
page read and write
265F000
stack
page read and write
30F0000
heap
page read and write
319B000
heap
page read and write
730000
heap
page read and write
30F6000
heap
page read and write
41A000
unkown
page write copy
3333000
heap
page read and write
97E0000
direct allocation
page read and write
2FA8000
heap
page read and write
32F4000
heap
page read and write
97E0000
direct allocation
page read and write
41A000
unkown
page write copy
401000
unkown
page execute read
401000
unkown
page execute read
400000
unkown
page readonly
3856000
heap
page read and write
3800000
heap
page read and write
420000
unkown
page write copy
32C5000
heap
page read and write
3409000
heap
page read and write
3331000
heap
page read and write
315B000
heap
page read and write
958000
heap
page read and write
359B000
heap
page read and write
4470000
heap
page read and write
9CD000
heap
page read and write
400000
unkown
page readonly
415E000
stack
page read and write
31B2000
direct allocation
page read and write
312B000
heap
page read and write
3263000
heap
page read and write
43B000
unkown
page read and write
32DC000
heap
page read and write
3354000
heap
page read and write
2DEE000
stack
page read and write
9AB000
heap
page read and write
30B1000
heap
page read and write
36A2000
heap
page read and write
97E0000
direct allocation
page read and write
3430000
direct allocation
page read and write
3BE3000
heap
page read and write
3418000
heap
page read and write
3D54000
heap
page read and write
447000
unkown
page read and write
411000
unkown
page readonly
94D000
heap
page read and write
3153000
heap
page read and write
435000
unkown
page execute read
43F000
heap
page read and write
40B0000
heap
page read and write
4450000
direct allocation
page read and write
197000
stack
page read and write
3143000
heap
page read and write
85E000
stack
page read and write
40EE000
heap
page read and write
20C4D000
heap
page read and write
409E000
unkown
page read and write
198000
stack
page read and write
60C000
heap
page read and write
3428000
heap
page read and write
326B000
heap
page read and write
1BF7F000
stack
page read and write
3261000
heap
page read and write
430E000
stack
page read and write
313F000
heap
page read and write
3409000
heap
page read and write
6080000
heap
page read and write
838000
heap
page read and write
3C38000
heap
page read and write
2A6E000
stack
page read and write
697000
heap
page read and write
97A000
heap
page read and write
33D9000
heap
page read and write
411000
unkown
page readonly
6EDB6000
unkown
page readonly
32F4000
heap
page read and write
40A0000
unkown
page readonly
32DC000
heap
page read and write
3374000
heap
page read and write
948000
heap
page read and write
1AC0000
direct allocation
page read and write
41B000
unkown
page write copy
4178000
heap
page read and write
198000
stack
page read and write
354F000
heap
page read and write
6B9000
heap
page read and write
33E7000
heap
page read and write
2A1F000
stack
page read and write
1A04000
unkown
page readonly
411000
unkown
page readonly
770000
heap
page read and write
435000
unkown
page execute read
3384000
heap
page read and write
3781000
heap
page read and write
3299000
heap
page read and write
440F000
stack
page read and write
3D34000
heap
page read and write
3460000
trusted library allocation
page read and write
3354000
heap
page read and write
3261000
heap
page read and write
2E60000
remote allocation
page read and write
3169000
heap
page read and write
409E000
unkown
page read and write
30B0000
heap
page read and write
97E0000
direct allocation
page read and write
410000
unkown
page readonly
19E000
stack
page read and write
9AB000
heap
page read and write
317B000
heap
page read and write
465F000
stack
page read and write
3182000
heap
page read and write
915000
heap
page read and write
31B0000
direct allocation
page read and write
6050000
heap
page read and write
3C3D000
heap
page read and write
3261000
heap
page read and write
4500000
direct allocation
page read and write
3344000
heap
page read and write
460F000
stack
page read and write
8F2000
heap
page read and write
91F000
stack
page read and write
2A0F000
stack
page read and write
3135000
heap
page read and write
444F000
stack
page read and write
1E561000
heap
page read and write
45E000
stack
page read and write
3499000
heap
page read and write
36D1000
heap
page read and write
3824000
heap
page read and write
4270000
heap
page read and write
400000
unkown
page readonly
35FD000
heap
page read and write
40A0000
unkown
page readonly
3B88000
heap
page read and write
420000
unkown
page write copy
3168000
heap
page read and write
6EDA0000
unkown
page readonly
2790000
heap
page read and write
31B0000
direct allocation
page read and write
99A000
heap
page read and write
DE1E000
stack
page read and write
40C0000
heap
page read and write
41E000
unkown
page write copy
3176000
heap
page read and write
3161000
heap
page read and write
37D8000
heap
page read and write
97E0000
direct allocation
page read and write
9C000
stack
page read and write
420000
unkown
page write copy
33B1000
heap
page read and write
83B000
heap
page read and write
3801000
heap
page read and write
51A000
remote allocation
page execute and read and write
276F000
stack
page read and write
3380000
heap
page read and write
19D000
stack
page read and write
36F1000
heap
page read and write
4B2000
unkown
page read and write
2F5F000
stack
page read and write
289F000
stack
page read and write
730000
heap
page read and write
3742000
heap
page read and write
353F000
heap
page read and write
3BFC000
heap
page read and write
411000
unkown
page readonly
2FB0000
remote allocation
page read and write
97E0000
direct allocation
page read and write
1A20000
heap
page read and write
4170000
heap
page read and write
40A0000
unkown
page readonly
3274000
heap
page read and write
3261000
heap
page read and write
2CEE000
stack
page read and write
2A10000
heap
page read and write
3752000
heap
page read and write
314E000
heap
page read and write
A4E000
stack
page read and write
3626000
heap
page read and write
97E0000
direct allocation
page read and write
2F9E000
heap
page read and write
97E0000
direct allocation
page read and write
3271000
heap
page read and write
41B000
unkown
page write copy
333E000
heap
page read and write
19D000
stack
page read and write
410E000
heap
page read and write
97E0000
direct allocation
page read and write
558000
remote allocation
page execute and read and write
3261000
heap
page read and write
330C000
heap
page read and write
93C000
heap
page read and write
3430000
direct allocation
page read and write
3299000
heap
page read and write
6F3000
heap
page read and write
352B000
heap
page read and write
3388000
heap
page read and write
33C1000
heap
page read and write
2B7E000
stack
page read and write
97E0000
direct allocation
page read and write
9D1000
heap
page read and write
410A000
heap
page read and write
3856000
heap
page read and write
35A7000
heap
page read and write
400000
unkown
page readonly
97E0000
direct allocation
page read and write
3D57000
heap
page read and write
3586000
heap
page read and write
1295E000
stack
page read and write
35A7000
heap
page read and write
358E000
stack
page read and write
3430000
direct allocation
page read and write
9B000
stack
page read and write
3801000
heap
page read and write
3603000
heap
page read and write
435000
unkown
page execute read
33A0000
heap
page read and write
2FB1000
heap
page read and write
3BE0000
heap
page read and write
3327000
heap
page read and write
97E0000
direct allocation
page read and write
357F000
heap
page read and write
37C2000
heap
page read and write
32D9000
heap
page read and write
511000
remote allocation
page execute and read and write
46DF000
stack
page read and write
955000
heap
page read and write
3D11000
heap
page read and write
3623000
heap
page read and write
40A0000
unkown
page readonly
3781000
heap
page read and write
8B5000
heap
page read and write
888000
heap
page read and write
95C000
heap
page read and write
3A60000
heap
page read and write
60D000
heap
page read and write
19A3E000
stack
page read and write
367D000
heap
page read and write
9C000
stack
page read and write
37D8000
heap
page read and write
265E000
stack
page read and write
1E918000
direct allocation
page readonly
314A000
heap
page read and write
3135000
heap
page read and write
3338000
heap
page read and write
2E71000
heap
page read and write
435000
unkown
page execute read
8B5000
heap
page read and write
3499000
heap
page read and write
28AF000
stack
page read and write
401000
unkown
page execute read
98F000
stack
page read and write
418000
heap
page read and write
93C000
heap
page read and write
400000
unkown
page readonly
900000
heap
page read and write
42A000
heap
page read and write
8F2000
heap
page read and write
3277000
heap
page read and write
33A9000
heap
page read and write
36EE000
heap
page read and write
3382000
heap
page read and write
1E708000
direct allocation
page execute read
4C0000
heap
page read and write
4510000
heap
page read and write
2FB0000
heap
page read and write
63E000
stack
page read and write
2B6D000
stack
page read and write
2E60000
remote allocation
page read and write
857000
heap
page read and write
97E0000
direct allocation
page read and write
A70000
heap
page read and write
1E942000
direct allocation
page read and write
369C000
heap
page read and write
3821000
heap
page read and write
32C4000
heap
page read and write
40A0000
unkown
page readonly
6F8000
heap
page read and write
6D9000
heap
page read and write
3327000
heap
page read and write
34EF000
heap
page read and write
3341000
heap
page read and write
422E000
heap
page execute and read and write
97E0000
direct allocation
page read and write
3BFA000
heap
page read and write
3390000
heap
page read and write
3103000
heap
page read and write
78E000
stack
page read and write
4168000
heap
page read and write
3106000
heap
page read and write
97E0000
direct allocation
page read and write
326B000
heap
page read and write
6B6000
heap
page read and write
31B0000
direct allocation
page read and write
3308000
heap
page read and write
97E0000
direct allocation
page read and write
420000
unkown
page write copy
716000
heap
page read and write
3430000
direct allocation
page read and write
3429000
heap
page read and write
420000
unkown
page write copy
3420000
heap
page read and write
3283000
heap
page read and write
315B000
heap
page read and write
3614000
heap
page read and write
97E0000
direct allocation
page read and write
2CEE000
stack
page read and write
435000
unkown
page execute read
418000
unkown
page write copy
40A0000
unkown
page readonly
2E70000
remote allocation
page read and write
443F000
stack
page read and write
3354000
heap
page read and write
981000
heap
page read and write
27AE000
stack
page read and write
31B0000
direct allocation
page read and write
19A00000
remote allocation
page read and write
40EE000
stack
page read and write
3193000
heap
page read and write
33D8000
heap
page read and write
3399000
heap
page read and write
1748E000
stack
page read and write
3184000
heap
page read and write
9BF000
heap
page read and write
97E0000
direct allocation
page read and write
19D000
stack
page read and write
3851000
heap
page read and write
3759000
heap
page read and write
326B000
heap
page read and write
94D000
heap
page read and write
1E5000
heap
page read and write
9CD000
heap
page read and write
4B2000
unkown
page read and write
333E000
heap
page read and write
3370000
heap
page read and write
959000
heap
page read and write
409E000
unkown
page read and write
9B000
stack
page read and write
420000
unkown
page write copy
1E0000
heap
page read and write
44EE000
stack
page read and write
2F7C000
heap
page read and write
983000
heap
page read and write
76E000
stack
page read and write
32FE000
stack
page read and write
783F000
stack
page read and write
342F000
stack
page read and write
3C38000
heap
page read and write
3441000
heap
page read and write
5FE0000
heap
page read and write
31AD000
heap
page read and write
725000
heap
page read and write
400000
unkown
page readonly
315B000
heap
page read and write
3151000
heap
page read and write
3193000
heap
page read and write
312B000
heap
page read and write
354F000
heap
page read and write
9BD000
heap
page read and write
3800000
heap
page read and write
314B000
heap
page read and write
3286000
heap
page read and write
435000
unkown
page execute read
316F000
heap
page read and write
3430000
direct allocation
page read and write
3368000
heap
page read and write
368D000
heap
page read and write
3712000
heap
page read and write
411000
unkown
page readonly
3AAF000
heap
page read and write
97E0000
direct allocation
page read and write
540000
heap
page read and write
420000
unkown
page write copy
33E5000
heap
page read and write
3363000
heap
page read and write
41BE000
stack
page read and write
97E0000
direct allocation
page read and write
7E9000
unkown
page readonly
3430000
direct allocation
page read and write
313B000
heap
page read and write
97E0000
direct allocation
page read and write
31AA000
heap
page read and write
315B000
heap
page read and write
197000
stack
page read and write
40A0000
unkown
page readonly
2480000
heap
page read and write
19B000
stack
page read and write
36B1000
heap
page read and write
A0F000
stack
page read and write
32A1000
heap
page read and write
906000
heap
page read and write
3169000
heap
page read and write
37D8000
heap
page read and write
2F87000
heap
page read and write
97E0000
direct allocation
page read and write
317D000
heap
page read and write
6E5000
heap
page read and write
8C0000
heap
page read and write
97E0000
direct allocation
page read and write
3771000
heap
page read and write
97E0000
direct allocation
page read and write
41A000
unkown
page write copy
3BE3000
heap
page read and write
983000
heap
page read and write
90F000
heap
page read and write
880000
heap
page read and write
3271000
heap
page read and write
915000
heap
page read and write
705000
heap
page read and write
6EDBF000
unkown
page readonly
6030000
heap
page read and write
3BE3000
heap
page read and write
418000
unkown
page read and write
314A000
heap
page read and write
6F5000
heap
page read and write
97E0000
direct allocation
page read and write
31B0000
direct allocation
page read and write
401000
unkown
page execute read
193000
stack
page read and write
3458000
heap
page read and write
33E9000
heap
page read and write
400000
unkown
page readonly
658000
heap
page read and write
316F000
heap
page read and write
9CD000
heap
page read and write
2BBE000
stack
page read and write
3150000
heap
page read and write
1ADA000
heap
page read and write
514000
remote allocation
page execute and read and write
400000
unkown
page readonly
3771000
heap
page read and write
3421000
heap
page read and write
318F000
heap
page read and write
33F8000
heap
page read and write
90E000
heap
page read and write
401000
unkown
page execute read
3626000
heap
page read and write
88F000
stack
page read and write
3187000
heap
page read and write
3171000
heap
page read and write
3BB6000
heap
page read and write
3144000
heap
page read and write
1BFEC000
stack
page read and write
40EA000
heap
page read and write
94D000
heap
page read and write
52B000
remote allocation
page execute and read and write
3BE0000
heap
page read and write
3291000
heap
page read and write
35B0000
heap
page read and write
41A000
unkown
page write copy
3C3D000
heap
page read and write
328C000
heap
page read and write
94D000
heap
page read and write
2BAE000
stack
page read and write
6FF000
heap
page read and write
3191000
heap
page read and write
401000
unkown
page execute read
29FF000
stack
page read and write
242F000
stack
page read and write
252E000
stack
page read and write
3800000
heap
page read and write
97E0000
direct allocation
page read and write
1742D000
stack
page read and write
3781000
heap
page read and write
8B6000
heap
page read and write
357F000
heap
page read and write
400000
unkown
page readonly
94C000
heap
page read and write
40A0000
unkown
page readonly
3C48000
heap
page read and write
197000
stack
page read and write
590000
heap
page read and write
35DE000
stack
page read and write
3411000
heap
page read and write
32C4000
heap
page read and write
6CC000
heap
page read and write
41A000
unkown
page read and write
20D94000
heap
page read and write
420000
unkown
page write copy
3261000
heap
page read and write
44E0000
heap
page read and write
5F6000
heap
page read and write
650000
heap
page read and write
26B0000
heap
page read and write
3161000
heap
page read and write
2FB0000
remote allocation
page read and write
438000
unkown
page write copy
529000
remote allocation
page execute and read and write
411000
unkown
page readonly
400000
unkown
page readonly
32C5000
heap
page read and write
319F000
heap
page read and write
3308000
heap
page read and write
908000
heap
page read and write
3630000
heap
page read and write
1A30000
heap
page read and write
3771000
heap
page read and write
35A7000
heap
page read and write
3430000
direct allocation
page read and write
2B6D000
stack
page read and write
6EDBD000
unkown
page read and write
3439000
heap
page read and write
97E0000
direct allocation
page read and write
409E000
unkown
page read and write
401000
unkown
page execute read
3430000
direct allocation
page read and write
314C000
heap
page read and write
52B000
remote allocation
page execute and read and write
313F000
heap
page read and write
2FB1000
heap
page read and write
4415000
heap
page execute and read and write
72B000
heap
page read and write
374F000
stack
page read and write
33C1000
heap
page read and write
97E0000
direct allocation
page read and write
3C83000
heap
page read and write
316F000
heap
page read and write
8A3000
heap
page read and write
37C9000
heap
page read and write
3261000
heap
page read and write
529000
remote allocation
page execute and read and write
3BFF000
heap
page read and write
3B21000
heap
page read and write
3BA5000
heap
page read and write
3A41000
heap
page read and write
333D000
heap
page read and write
361C000
heap
page read and write
3430000
direct allocation
page read and write
317B000
heap
page read and write
8E2000
heap
page read and write
367D000
heap
page read and write
1F0000
heap
page read and write
3182000
heap
page read and write
315F000
heap
page read and write
3388000
heap
page read and write
30B0000
heap
page read and write
3BFC000
heap
page read and write
33F8000
heap
page read and write
3460000
heap
page read and write
4B2000
unkown
page read and write
313F000
heap
page read and write
610000
heap
page read and write
90F000
heap
page read and write
97E0000
direct allocation
page read and write
314A000
heap
page read and write
4210000
heap
page read and write
7F7000
heap
page read and write
2A10000
heap
page read and write
33F8000
heap
page read and write
40A0000
unkown
page readonly
28CF000
stack
page read and write
338D000
heap
page read and write
520000
heap
page read and write
6E4000
heap
page read and write
3290000
heap
page read and write
430E000
stack
page read and write
540000
heap
page read and write
1F0000
heap
page read and write
420000
unkown
page write copy
8BB000
heap
page read and write
7E9000
unkown
page readonly
31AD000
heap
page read and write
40A0000
unkown
page readonly
3310000
heap
page read and write
600000
heap
page read and write
400000
unkown
page readonly
2060000
heap
page read and write
3380000
heap
page read and write
1A60000
heap
page read and write
52B000
remote allocation
page execute and read and write
3170000
heap
page read and write
2FB1000
heap
page read and write
3308000
heap
page read and write
35B0000
heap
page read and write
5FE000
heap
page read and write
32A1000
heap
page read and write
278F000
stack
page read and write
9CD000
heap
page read and write
315A000
heap
page read and write
3344000
heap
page read and write
97E0000
direct allocation
page read and write
97E0000
direct allocation
page read and write
37C2000
heap
page read and write
3280000
heap
page read and write
82E000
stack
page read and write
323D000
stack
page read and write
3533000
heap
page read and write
9B000
stack
page read and write
447000
unkown
page read and write
800000
heap
page read and write
193000
stack
page read and write
3436000
heap
page read and write
35D4000
heap
page read and write
265E000
stack
page read and write
83B000
heap
page read and write
3D57000
heap
page read and write
3370000
heap
page read and write
438000
unkown
page write copy
3300000
heap
page read and write
316D000
heap
page read and write
32C4000
heap
page read and write
3B88000
heap
page read and write
3430000
direct allocation
page read and write
3430000
direct allocation
page read and write
9C000
stack
page read and write
443A000
heap
page execute and read and write
316D000
heap
page read and write
411000
unkown
page readonly
32C4000
heap
page read and write
193000
stack
page read and write
2570000
heap
page read and write
332B000
heap
page read and write
3184000
heap
page read and write
35F0000
heap
page read and write
326D000
heap
page read and write
3A51000
heap
page read and write
2CAF000
stack
page read and write
94D000
heap
page read and write
338D000
heap
page read and write
33B1000
heap
page read and write
354F000
heap
page read and write
359B000
heap
page read and write
8A0000
heap
page read and write
313A000
heap
page read and write
400000
unkown
page readonly
35B0000
heap
page read and write
C30000
heap
page read and write
411000
unkown
page readonly
30B0000
heap
page read and write
97E0000
direct allocation
page read and write
316F000
heap
page read and write
90E000
heap
page read and write
401000
unkown
page execute read
3C48000
heap
page read and write
2FB1000
heap
page read and write
1A04000
unkown
page readonly
3290000
heap
page read and write
915000
heap
page read and write
4218000
heap
page read and write
97E0000
direct allocation
page read and write
332D000
heap
page read and write
45B0000
heap
page read and write
5C0000
heap
page read and write
6A2000
heap
page read and write
409E000
unkown
page read and write
40A0000
unkown
page readonly
97E0000
direct allocation
page read and write
3176000
heap
page read and write
9C000
stack
page read and write
69E000
stack
page read and write
3CF4000
heap
page read and write
3AE1000
heap
page read and write
3452000
heap
page read and write
8F8000
heap
page read and write
4AE000
stack
page read and write
8C0000
heap
page read and write
1B0C000
heap
page read and write
8E9000
heap
page read and write
3BFC000
heap
page read and write
37D8000
heap
page read and write
94A000
heap
page read and write
3170000
heap
page read and write
275F000
stack
page read and write
37C9000
heap
page read and write
45D0000
heap
page read and write
1E560000
heap
page read and write
41A000
unkown
page write copy
3430000
direct allocation
page read and write
8B3000
heap
page read and write
83B000
heap
page read and write
32E0000
heap
page read and write
376E000
heap
page read and write
9B000
stack
page read and write
3389000
heap
page read and write
97E2000
direct allocation
page read and write
529000
remote allocation
page execute and read and write
2D1E000
stack
page read and write
3BFF000
heap
page read and write
7E9000
unkown
page readonly
3161000
heap
page read and write
3168000
heap
page read and write
2BAE000
stack
page read and write
400000
unkown
page readonly
695000
heap
page read and write
97E0000
direct allocation
page read and write
97E0000
direct allocation
page read and write
33F8000
heap
page read and write
9C000
stack
page read and write
2FB0000
remote allocation
page read and write
461F000
stack
page read and write
3360000
heap
page read and write
6EA000
heap
page read and write
1E701000
direct allocation
page execute read
39D9000
heap
page read and write
261F000
stack
page read and write
63F000
remote allocation
page execute and read and write
3644000
heap
page read and write
2F8A000
heap
page read and write
438000
unkown
page write copy
3430000
direct allocation
page read and write
338A000
stack
page read and write
3820000
heap
page read and write
97E0000
direct allocation
page read and write
36DF000
stack
page read and write
313F000
heap
page read and write
702000
heap
page read and write
690000
heap
page read and write
313B000
heap
page read and write
32E0000
heap
page read and write
900000
heap
page read and write
32C4000
heap
page read and write
420000
unkown
page write copy
3BA5000
heap
page read and write
32F1000
heap
page read and write
2070000
heap
page read and write
3B21000
heap
page read and write
40A0000
unkown
page readonly
359D000
stack
page read and write
368D000
heap
page read and write
3430000
direct allocation
page read and write
8DF000
stack
page read and write
400000
unkown
page readonly
41A000
unkown
page read and write
9C2000
heap
page read and write
32C5000
heap
page read and write
2F74000
heap
page read and write
1ADE000
heap
page read and write
3177000
heap
page read and write
2F9F000
stack
page read and write
97E0000
direct allocation
page read and write
423E000
stack
page read and write
36F1000
heap
page read and write
409E000
unkown
page read and write
6FB000
heap
page read and write
3B88000
heap
page read and write
51A000
remote allocation
page execute and read and write
3A6F000
heap
page read and write
19B000
stack
page read and write
3C6A000
heap
page read and write
312B000
heap
page read and write
26B0000
heap
page read and write
97E0000
direct allocation
page read and write
330C000
heap
page read and write
35DF000
heap
page read and write
3752000
heap
page read and write
3856000
heap
page read and write
2A7E000
stack
page read and write
3331000
heap
page read and write
420000
unkown
page write copy
6E7000
heap
page read and write
401000
unkown
page execute read
401000
unkown
page execute read
90D000
heap
page read and write
197000
stack
page read and write
B8F000
stack
page read and write
4318000
heap
page read and write
3781000
heap
page read and write
93C000
heap
page read and write
3491000
heap
page read and write
97E0000
direct allocation
page read and write
9B000
stack
page read and write
419000
unkown
page write copy
329F000
heap
page read and write
3269000
heap
page read and write
41B000
unkown
page write copy
2E70000
remote allocation
page read and write
95E000
heap
page read and write
3410000
heap
page read and write
3CA0000
heap
page read and write
32D9000
heap
page read and write
420000
unkown
page write copy
401000
unkown
page execute read
315F000
heap
page read and write
3A60000
heap
page read and write
2BAE000
stack
page read and write
3781000
heap
page read and write
40B0000
heap
page read and write
97E0000
direct allocation
page read and write
333F000
heap
page read and write
33AD000
heap
page read and write
3270000
heap
page read and write
8CD000
heap
page execute and read and write
44EE000
stack
page read and write
400000
unkown
page readonly
31B0000
direct allocation
page read and write
362B000
heap
page read and write
3BE3000
heap
page read and write
7F6000
heap
page read and write
411000
unkown
page readonly
334B000
heap
page read and write
400000
unkown
page readonly
27CE000
stack
page read and write
97E0000
direct allocation
page read and write
3430000
direct allocation
page read and write
40FE000
stack
page read and write
8DD000
heap
page read and write
7E5000
heap
page read and write
97E0000
direct allocation
page read and write
983000
heap
page read and write
40A0000
unkown
page readonly
3B88000
heap
page read and write
35F0000
heap
page read and write
410000
unkown
page readonly
29FF000
stack
page read and write
313A000
heap
page read and write
32F5000
heap
page read and write
314C000
heap
page read and write
596000
heap
page read and write
2E1F000
stack
page read and write
3491000
heap
page read and write
835000
heap
page read and write
5D0000
heap
page read and write
32D5000
heap
page read and write
955000
heap
page read and write
438000
unkown
page write copy
32F9000
heap
page read and write
6A7000
heap
page read and write
3C06000
heap
page read and write
35CF000
stack
page read and write
2D1E000
stack
page read and write
3287000
heap
page read and write
354F000
heap
page read and write
3450000
heap
page read and write
3CF4000
heap
page read and write
3BB6000
heap
page read and write
607000
heap
page read and write
195000
stack
page read and write
41A000
unkown
page write copy
3461000
heap
page read and write
1E965000
heap
page read and write
3D11000
heap
page read and write
3428000
heap
page read and write
1A04000
unkown
page readonly
3263000
heap
page read and write
97E0000
direct allocation
page read and write
3BE0000
heap
page read and write
31B0000
direct allocation
page read and write
411000
unkown
page readonly
33F8000
heap
page read and write
42A000
heap
page read and write
97E0000
direct allocation
page read and write
4B2000
unkown
page read and write
2CEE000
stack
page read and write
314A000
heap
page read and write
9AF000
stack
page read and write
990000
heap
page read and write
2F5F000
stack
page read and write
3191000
heap
page read and write
35D0000
heap
page read and write
44F0000
direct allocation
page read and write
3BE0000
heap
page read and write
362C000
heap
page read and write
37C9000
heap
page read and write
568000
heap
page read and write
3B09000
heap
page read and write
31B0000
direct allocation
page read and write
3263000
heap
page read and write
36E1000
heap
page read and write
193000
stack
page read and write
9B000
stack
page read and write
2FB0000
remote allocation
page read and write
3800000
heap
page read and write
7BE000
stack
page read and write
410000
unkown
page readonly
362B000
heap
page read and write
9B000
stack
page read and write
97E0000
direct allocation
page read and write
31AD000
heap
page read and write
97E0000
direct allocation
page read and write
7E9000
unkown
page readonly
1F0000
heap
page read and write
269E000
stack
page read and write
32C4000
heap
page read and write
3800000
heap
page read and write
198000
stack
page read and write
3781000
heap
page read and write
1035F000
stack
page read and write
3341000
heap
page read and write
420000
unkown
page write copy
3152000
heap
page read and write
3286000
heap
page read and write
2DFD000
stack
page read and write
32E9000
heap
page read and write
3388000
heap
page read and write
2FB0000
heap
page read and write
983000
heap
page read and write
2E5E000
stack
page read and write
401000
unkown
page execute read
401000
unkown
page execute read
3191000
heap
page read and write
97E0000
direct allocation
page read and write
3800000
heap
page read and write
2FB0000
remote allocation
page read and write
32D5000
heap
page read and write
318D000
heap
page read and write
7E6000
unkown
page read and write
835000
heap
page read and write
32C4000
heap
page read and write
902000
heap
page read and write
3409000
heap
page read and write
510000
heap
page read and write
7EF000
stack
page read and write
3771000
heap
page read and write
3752000
heap
page read and write
3D13000
heap
page read and write
3148000
heap
page read and write
9B000
stack
page read and write
2B6D000
stack
page read and write
3430000
direct allocation
page read and write
318D000
heap
page read and write
3430000
direct allocation
page read and write
96E000
stack
page read and write
3145000
heap
page read and write
48BF000
stack
page read and write
37D8000
heap
page read and write
450F000
stack
page read and write
8DB000
heap
page read and write
2A10000
heap
page read and write
327D000
stack
page read and write
359C000
heap
page read and write
349C000
heap
page read and write
3626000
heap
page read and write
3603000
heap
page read and write
3342000
heap
page read and write
3418000
heap
page read and write
3186000
heap
page read and write
444E000
stack
page read and write
103CE000
stack
page read and write
31B0000
direct allocation
page read and write
6A0000
heap
page read and write
30B0000
heap
page read and write
3390000
heap
page read and write
3430000
direct allocation
page read and write
7E9000
unkown
page readonly
401000
unkown
page execute read
2A6E000
stack
page read and write
2A0F000
stack
page read and write
3732000
heap
page read and write
1E6F0000
heap
page read and write
400000
unkown
page readonly
400000
unkown
page readonly
8F8000
heap
page read and write
97E8000
direct allocation
page read and write
3851000
heap
page read and write
41A000
unkown
page write copy
97E0000
direct allocation
page read and write
6B8000
heap
page read and write
32A5000
heap
page read and write
8AF000
stack
page read and write
32C4000
heap
page read and write
9810000
trusted library allocation
page read and write
39A1000
heap
page read and write
401000
unkown
page execute read
90E000
stack
page read and write
9B9000
heap
page read and write
327B000
heap
page read and write
411000
unkown
page readonly
3626000
heap
page read and write
3CEF000
heap
page read and write
8E9000
heap
page read and write
7D7000
heap
page read and write
420000
unkown
page write copy
40A0000
unkown
page readonly
333D000
heap
page read and write
329F000
heap
page read and write
2CBE000
stack
page read and write
41A000
unkown
page write copy
41A000
unkown
page read and write
33E1000
heap
page read and write
41A000
unkown
page read and write
31AA000
heap
page read and write
32C4000
heap
page read and write
333E000
heap
page read and write
3BA5000
heap
page read and write
9C4000
heap
page read and write
290E000
stack
page read and write
41C0000
heap
page read and write
37C9000
heap
page read and write
1A02000
unkown
page read and write
199CD000
stack
page read and write
5F1000
remote allocation
page execute and read and write
32F5000
heap
page read and write
3A6F000
heap
page read and write
266E000
stack
page read and write
3399000
heap
page read and write
3430000
direct allocation
page read and write
28FE000
stack
page read and write
411000
unkown
page readonly
460000
heap
page read and write
97E0000
direct allocation
page read and write
400000
unkown
page readonly
8B5000
heap
page read and write
32E7000
heap
page read and write
1EB9E000
stack
page read and write
32E7000
heap
page read and write
B89E000
stack
page read and write
2FB1000
heap
page read and write
41A000
unkown
page write copy
3279000
heap
page read and write
32C4000
heap
page read and write
40F0000
heap
page read and write
32D5000
heap
page read and write
32C4000
heap
page read and write
31A0000
heap
page read and write
3BFA000
heap
page read and write
32C5000
heap
page read and write
33F1000
heap
page read and write
3D16000
heap
page read and write
40B0000
heap
page read and write
650000
heap
page read and write
1AEE000
heap
page execute and read and write
2CAF000
stack
page read and write
33E3000
heap
page read and write
35DF000
heap
page read and write
3363000
heap
page read and write
19B000
stack
page read and write
6DE000
stack
page read and write
2CAF000
stack
page read and write
97E0000
direct allocation
page read and write
317B000
heap
page read and write
3430000
direct allocation
page read and write
97E0000
direct allocation
page read and write
3430000
direct allocation
page read and write
3481000
heap
page read and write
3176000
heap
page read and write
400000
unkown
page readonly
5A7000
heap
page read and write
4413000
heap
page execute and read and write
318D000
heap
page read and write
2FB0000
remote allocation
page read and write
19B000
stack
page read and write
19B000
stack
page read and write
2E1F000
stack
page read and write
35A7000
heap
page read and write
4100000
heap
page read and write
251E000
stack
page read and write
411000
unkown
page readonly
349C000
stack
page read and write
967000
heap
page read and write
411000
unkown
page readonly
529000
remote allocation
page execute and read and write
315B000
heap
page read and write
1EBA0000
heap
page read and write
9D0000
heap
page read and write
6020000
heap
page read and write
332B000
heap
page read and write
3C06000
heap
page read and write
906000
heap
page read and write
2290000
heap
page read and write
24EF000
stack
page read and write
4B2000
unkown
page read and write
197000
stack
page read and write
3626000
heap
page read and write
777000
heap
page read and write
3851000
heap
page read and write
315E000
heap
page read and write
14E9E000
stack
page read and write
905000
heap
page read and write
902000
heap
page read and write
2E71000
heap
page read and write
3C23000
heap
page read and write
461F000
stack
page read and write
420000
unkown
page write copy
915000
heap
page read and write
400000
unkown
page readonly
5B8000
heap
page read and write
3800000
heap
page read and write
41E000
unkown
page write copy
1F0000
heap
page read and write
313F000
heap
page read and write
315F000
heap
page read and write
2CBE000
stack
page read and write
314A000
heap
page read and write
4458000
heap
page execute and read and write
355B000
heap
page read and write
3305000
heap
page read and write
3800000
heap
page read and write
8F2000
heap
page read and write
35FB000
heap
page read and write
3371000
heap
page read and write
3286000
heap
page read and write
There are 1789 hidden memdumps, click here to show them.