top title background image
flash

payload.exe

Status: finished
Submission Time: 2020-05-30 19:20:36 +02:00
Malicious
Ransomware
Adware
Evader
Crysis Wadhrama

Comments

Tags

Details

  • Analysis ID:
    234410
  • API (Web) ID:
    364957
  • Analysis Started:
    2020-05-30 19:20:36 +02:00
  • Analysis Finished:
    2020-05-30 19:28:33 +02:00
  • MD5:
    56ba37144bd63d39f23d25dae471054e
  • SHA1:
    088e2aff607981dfe5249ce58121ceae0d1db577
  • SHA256:
    307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious

URLs

Name Detection
http://schemas.live.com/Web//Init
https://login.windows.net/
https://aefd.nelreports.net/api/report?cat=bingaot
Click to see the 34 hidden entries
https://outlook.office.com/User.ReadWrite
http://schemas.live.com/Web/
https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/
https://pf.directory.live.com/profile/profile.asmxoftwar
http://www.jiyu-kobo.co.jp/
https://substrate.office.com/api/v2.0/Users(
https://substrate.office.com/profile/v0/users/
http://www.founder.com.cn/cn
https://aefd.nelreports.net/api/report?cat=bingrms
http://www.fonts.com
http://www.sandoll.co.kr
https://graph.windows.net/
https://aefd.nelreports.net/api/report?cat=bingrmr
http://www.zhongyicts.com.cn
http://www.sakkal.com
https://xsts.auth.xboxlive.com/
https://.com
http://www.apache.org/licenses/LICENSE-2.0
http://www.founder.com.cn/cn/bThe
https://substrate.office.com/search/api/v2/resources
https://www.msn.com/spartan/dhpP
http://schemas.live.com/Web/l
http://www.tiro.com
https://mths.be/fromcodepoint
http://www.goodfont.co.kr
http://facebook.github.io/react/docs/error-decoder.html?invariant
http://schema.org/reminder
https://outlook.office.com/
https://www.msn.com/spartan/ntp
http://www.carterandcone.coml
http://www.sajatypeworks.com
http://www.typography.netD
http://www.founder.com.cn/cn/cThe
http://fontfabrik.com

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\x-none.16\MasterDescriptor.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
Click to see the 97 hidden entries
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Network\Downloader\edb.log.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\windows.uif_ondemand.xml.inbox.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\en-us.16\stream.x86.en-us.man.dat.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\ARM\S\ARM.msi.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\ARM\S\18392\AdobeARM.msi.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\en-us.16\MasterDescriptor.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\ARM\S\20227\AdobeARMHelper.exe.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\ARM\S\20227\AdobeARM.msi.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\ARM\S\18392\AdobeARMHelper.exe.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\MF\Pending.GRL.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime\0__Power_Policy.provxml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\customizations.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\MasterDatastore.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Network\Downloader\edb.chk.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\MasterDatastore.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\MF\Active.GRL.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime\0__Power_Policy.provxml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Diagnosis\WindowsAnalytics\analyticsevents.dat.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Diagnosis\OfflineSettings\offlineblocklist.json.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime\0__Power_Policy.provxml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime\0__Power_Controls.provxml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\MasterDatastore.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\customizations.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime\0__Power_Policy.provxml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\customizations.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\MasterDatastore.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\customizations.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\MasterDatastore.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime\0__Power_Policy.provxml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\MasterDatastore.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\customizations.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\en-us.16\stream.x86.en-us.hash.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\en-us.16\s321033.hash.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\en-us.16\Stream.Platform.Culture.man.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\x-none.16\Stream.Platform.x-none.man.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft OneDrive\setup\refcount.ini.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1801120055.msp.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\$Recycle.Bin\S-1-5-21-58933367-3072710494-194312298-1002\desktop.ini.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\$Recycle.Bin\S-1-5-21-58933367-3072710494-194312298-1001\desktop.ini.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.proofing.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Crypto\SystemKeys\2a93be7b9edd8106bd690cc3d501a405_59407d34-c8c5-44df-a766-ba8a11cb1cb0.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.diffbase.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemuiset.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64muiset.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\x-none.16\stream.x86.x-none.man.dat.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\x-none.16\stream.x86.x-none.hash.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\A605F2A5-9D01-4691-9FDC-BE6391D70203\x-none.16\s320.hash.id-AD9953CA.[Bit_decrypt@protonmail.com].BOMBO
data
#