35ae37f5...4835 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Wiper, Ransomware, Trojan

ContinuumLoosely.exe

Windows Exe (x86-32)

Created at 2019-12-23T13:24:00

...

Remarks (1/1)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (1253)
»
Filename Hash Operations Category
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini - Access, Read, Delete
C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER MD5: ab4c2930d5d4bc306c293a3757dcc60e
SHA1: 749989fc5fa82efd348f8afa1d5ed7718f73e2d4
SHA256: 5517ddd7f3986e05132e9911e18190e8ce35822de1c86e5b6631188dece41806
SSDeep: 6:KXBFoNB+nfmua7sbvtnc6WC7gT2Ke6lkoi10HWP9pd9Rb9S7D:qk+C7sLV3s2ojU0HWd9l9S7D
ImpHash: None 		Access, Create, Write Dropped File
C:\Boot\BCD - Access
C:\Boot\BCD.LOG - Access
C:\Boot\BCD.LOG1 - Access
C:\Boot\BCD.LOG2 - Access
C:\Boot\BOOTSTAT.DAT - Access, Read, Delete
C:\Boot\BOOTSTAT.DAT.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 8a6bde3e8346d67d4e2eabd62d24083a
SHA1: a5bc739e4e1fb35150f9c9d1a54cc93b41b2bbbf
SHA256: 1b9b5debf808b7ba37c7eebc8f887ee864ff1f0317028df18a8bbaebb70578e1
SSDeep: 1536:BnJYMw84gHWvOu07Y0Ko+9BQwMTQWIsIGKhk+XzNEEFWKDs:9dw87Uy+9uwMTBpKhtzKEFWKY
ImpHash: None 		Access, Create, Write Dropped File
C:\Boot\cs-CZ\bootmgr.exe.mui - Access
C:\Boot\cs-CZ\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\da-DK\bootmgr.exe.mui - Access
C:\Boot\da-DK\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\de-DE\bootmgr.exe.mui - Access
C:\Boot\de-DE\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\el-GR\bootmgr.exe.mui - Access
C:\Boot\el-GR\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\Fonts\chs_boot.ttf - Access, Delete
C:\Boot\Fonts\chs_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Boot\Fonts\cht_boot.ttf - Access, Delete
C:\Boot\Fonts\cht_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Boot\Fonts\jpn_boot.ttf - Access, Delete
C:\Boot\Fonts\jpn_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Boot\Fonts\kor_boot.ttf - Access, Delete
C:\Boot\Fonts\kor_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Boot\Fonts\wgl4_boot.ttf - Access
C:\Boot\Fonts\wgl4_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\fr-FR\bootmgr.exe.mui - Access
C:\Boot\fr-FR\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\hu-HU\bootmgr.exe.mui - Access
C:\Boot\hu-HU\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\it-IT\bootmgr.exe.mui - Access
C:\Boot\it-IT\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\ja-JP\bootmgr.exe.mui - Access
C:\Boot\ja-JP\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\ko-KR\bootmgr.exe.mui - Access
C:\Boot\ko-KR\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Boot\memtest.exe - Access
C:\Boot\memtest.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\BOOTSECT.BAK - Access, Read, Delete
C:\BOOTSECT.BAK.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 672c4c61bbfa4f4c9b5aec76db4142b3
SHA1: 6de7b81fb498b15298ceb61f87a9009a4cfc19b6
SHA256: 559ceda27dee637c60d5a632c1048e91b5114eb436e93cb248401068780ab1c9
SSDeep: 192:EukUyqA85ktznbiZonYnQUGUohPnyba4lZwFWrWI1PqRxf/I:EGyHtfZnYnQUjoh/ybacZwylPl
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 2fb10a322517f7cbfb3a6cfe3f7ec571
SHA1: f50dbea0bf05e4a4f73abb265fef52fa43db4e07
SHA256: 5ef870f132dab830dd5380a5f66f2db9ead790ee6610fc191c638c2aecd616a4
SSDeep: 196608:6a8A7fKP0ReD0wXKLUEfRrDXP2ifogB2jHcSBLWiyvyWJRMLhdPWfi:6aRDKP0q0wM9JrL2ifJcjhW/6vL3Ai
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 39df7949462f9c6811ee281e0435be62
SHA1: 10f88819e3dc394d2d8959e31c28ddd0d8967a1c
SHA256: 6649552ecb237f67d812852d5e05a1ac07481aca928f58d137cb2c869fe47a99
SSDeep: 49152:zDxL8QBo0Tex4S120ytJyqpm8iwiQdZky9Mqf:zR89t1SpDisj9Mc
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 1ba937e8f4aee7b44360462cce12531e
SHA1: a486ca500e5f309660b50cf76d110b255b9bba97
SHA256: ac471d0df73361642a6e7edd76cdd1655de20601e698751f5924b1f7f7e2ccdc
SSDeep: 24:GKOT2Th9QBSTRARHZApiE9jynm1a4RI43+ObqrSVX7PMLk8Z2cE8lrl5GeGpWd9g:nu2Thj6Zef1L2ugP2/Gl5Gezla
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 05c04131cd393f2fe6361224fe663081
SHA1: ca61f2a9d08a0b905a016a317b7cabf46f824f2f
SHA256: 623d1cd23e9b32d0f42eba3dabbd53168bcd79e2c160459f0cbd16d0cbad7c1d
SSDeep: 48:bRsptWo0Mdg4jIk05IddZXRTRMKZCw6VCWcazrk69+i2K6vdig1CW/I8Zp2OjlA:FsptkMe40k05IdTBTlCwXdazwM+iHLgA
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: c95d12ef8df958fa20c613db64ba60e6
SHA1: b927cec6a8107aceb4a6c5a94682f050349dd691
SHA256: 3808520df56c0e00e2b2cd36bba895ed69914a85393f2c8cede9b7bcbeefa068
SSDeep: 49152:zDxL8QBo6Tex4S120ytJyWgc88OCYtHeoh1ccZYG/3:zR89j1ugvyCN5f
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 38eb17d0fc55e68c4fe4b0f68191ae9d
SHA1: 2aa4db495ec637a0be66fa699f1d0e91f7781cd7
SHA256: 54d7c92bf1a3029f7126dbbbcebdcf7b0a3338f4ff9807f37fc5c793ec3fe343
SSDeep: 48:pVDaiPWVMg2oZtxdvOMlTUt4fW3IfBM4te84lQ:fDFqDlpU+fW36L4K
ImpHash: None 		Access, Create Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 6b078cbccbab0d5edeaa1d85f11ba58a
SHA1: 66820f091ea72f244d2d2019748cbda0b7b9702d
SHA256: 7597007b7fd82fa6fc079ad255cc80561c20be4bc515df7968b4b0e377292774
SSDeep: 196608:H4KKCX5FvaeoDcBdxmOJR7nxOKOmE7dzaNQwr:H4KKCX5FvaVczxmUJnYSE7dzAT
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: a50991c429f65692d0184196e2d06b72
SHA1: 4139f2c4b975a6209938abf2c987492e05275b3e
SHA256: 3e9a537774dff6ba42ec0ba5f871a08452c9f5aae499a129241951f25eaed4ff
SSDeep: 48:ojbcJ/20SNbIj4vIXOsmSM0SSWP/KYmFSKJ0ieWzT92XhlqCe/mlA:oHcJbSbIj4Q+nSMXP/KxcieC2t6m6
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: c55c9fd2a997f1566ea490bbe98f2180
SHA1: fa8110e4d5398d3a22f497dfb6b938c8d8dd7779
SHA256: e735d5eb6192ab56095fc846efd3b24d5b9c68459fcb2270a07eddb13108994e
SSDeep: 49152:zDxL8QBonTex4S120ytJydHkaRYjOaGgDmm+wEY:zR89K1VEpjtPFEY
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: e76ab2bfcc83130b460bc8cb7b0c273b
SHA1: b95c1c5aebdaf3f99bf396af6e1fdfe387fae575
SHA256: 138cdbba5c7cb5b0899fc1580f11cd5caec0d10df54a48e1c5443d405ca29244
SSDeep: 48:br5S7euZm9cwC8UK/GC+CRg4GiiQ/O3CuXtpeYlS:wZm9VUOGbQPil3ttI
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: c95888a2fe0683155efe70b4f5c99f31
SHA1: 17c48a137328082c4864256218c1b88a84b0bb4f
SHA256: 9282d48d712e3cad74b423d4a6dfe205e240b9d850312fb1d816330ec9031088
SSDeep: 196608:aPUvTYpH9RBl/tus7o4L7tZiTnp/jE4U/bxlLRx+gU:MUvTiNhU4L7tZiTnprP0txRsgU
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: eba4dcae35c3b706a9f48ab34c5550dc
SHA1: 0e26657391ab8b2db69bd8a8500e3542e305a320
SHA256: ff954481f891ee77430ce51f199b142fdc12a3de6e1808a04550e5247a0dba29
SSDeep: 48:wAWgpgNIb2C6ZriJHsSYxZjtT7nruKYWfkUDFa0lA:wAWgp8ENQri2SY7tT7nPVDE06
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 0132354deb06c352353675fce278a129
SHA1: 82f447263c0d4d83d398af15034413083edcbc35
SHA256: 8e5451128ff68d309300dd54c2a3bb83f196e6fefb39f1e8d6b7c24b8a6f7307
SSDeep: 196608:TIwm3nNVAl+ig71eZ8FclBElWHEbyLbyo9crpLlR8ioLO0ZF9CrpbQ:OL71eiFge/GHyo2rpLkcoCrpbQ
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: b21c9a8c55d397351918f59113484fe8
SHA1: 2a3e973f4f69fd01b7f5b914c33f33bd71476734
SHA256: 20dcf2036ecc4e6b420123b2512154d8149fde08f39e9043e15a42ef90d9a93e
SSDeep: 49152:fHYLL/WoWLljb1R6rOSN20yRJ6Jb6iVIfDcnY:fqLVW6vFbxVI7cnY
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: b6fc1d05bd823fed3fc116717cc22c57
SHA1: feb9f7c1165916398d3a9215495ceff281449b7e
SHA256: c3804bd8da565f2550099215157e7a8e0762721b8df97ba5cf3fed62afbce971
SSDeep: 96:SK3ERYAX8poq5Y4ypIIw5vHzGwrS3MS5z7vma3Z9omUPnq9IhZjXC+M:bjC8+q5PGw8F5z7vmaEmUS9Ii
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: a4ab7accbf83fc063b663dc9ac14657e
SHA1: 30084659c658d8ee8bbe7309df8184fa297883cc
SHA256: 0d654a5b1f9adac0fb788d35473e3d9a3cb12c56270c298e3821db46f7aa7842
SSDeep: 96:sU2e0i/Zlgc3+LqYzKhqWPoKWixFEgk/qrisAoZ9PnrJs6:s9eMkgdOhqWPoUxFEpuPXfrJX
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 898d69b71d7258de5e86e51906e5b4b1
SHA1: b78a21b0cadb83fcf55906938039150c1fd46afa
SHA256: 410e2c653f1fdcafd3003874615c76b10a9d4f4279c32b27580eb8def316b2c8
SSDeep: 48:ySg35GA2whJYUvZfBX0cbAAzzA4MN4tGG06PVJaN7sAlA:p2/WeBRbAE8ktGG06PTaiA6
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 4fb6c079967f604d4b8cdf477caf6de0
SHA1: a8777ca0e49e5d98d01a6b007c7b62b5dffb5b63
SHA256: 9fac05c1ffc4b8060b0a5b942d35cc90c0bff012af1a00a6712c6d03018b083f
SSDeep: 196608:MaurJM4k8IMj3kMxfGbWaxJMKMA4JxuiNQG3A2r7rfiSFhysD8uxDxKj:EOn8IQkM2BFEx96G3AUf7FnzKj
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 50ac83a61ae3d057b23787762876feb7
SHA1: 0146eb89c47a927453d5027e323555839c6ac92d
SHA256: 496e8584470ba27d207a8b047c1d54c1000ff38469d7cdad9adcb73b2256b2d8
SSDeep: 49152:zDxL8QBoSTex4S120ytJy88YQZfx4w4Jta8oS:zR89r105QQlgS
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: f0bbd4662d6ef9e367ff49c22c62a96f
SHA1: a9bfd819e6afdaa1186cef8cfc58ccf25f8e4ae9
SHA256: b49b7fa444e7c1087130d78b05271c5717965b5ed78b778a15c73fdf86b3b5f8
SSDeep: 48:BN4IeKdtjtoqMOSxVRkXss10ljLnovlqRe6kllE:BNtHdtjGqMOQVq0vnklqzkl2
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab - Access, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 052b4a3aaf24e1879297e0f1408c7662
SHA1: ccf2d2087988828f8117c27f1ec3ccaf4b5b926d
SHA256: 6c23fd16b44e1eefdf52ac7ad99a1fc46a9b4b3e77c6643dd26d1ad79a2d1021
SSDeep: 196608:Vf1gRyjQR9g8YYIcjfXontQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:V1WbR9YY5AJGBZWGRz1kaza0h
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: e387ccd4dedd5688c7169c29fb2402df
SHA1: 95eb51a72335814c55b775b08680061b9b4c84dd
SHA256: bbb8792b49773c1b2081c7f8421ad0a6b5db2670271c175954921be27024ee89
SSDeep: 24576:Z8ymLy7io/kgSJ/Iemn7GMKfMKU88g/kXX9:Z8ymLA7jSJ5mnCT0188Ak9
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: fc136165dc36d4098b8388aa202c6279
SHA1: a5218bd1ea4c3d25286bb10633db6f67239621e1
SHA256: 030595cd8c0a9bfeb787f6c2c2b1b4aec7f545b3d42fdeccb08a541b7c0f7b99
SSDeep: 24:PF+ZnN8Ux8lMne/3ka4iQYR9pduO/mngn26al69LkOIe4TOYLrcQHRjpWd9lA:IZnN5iMnevkViQ+MOe025l6k02zRUlA
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab - Access, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 42ac6eff5aa1dad153cb32ec3d616e43
SHA1: 8d8693b1d4aa27f2f48345e6f2e760c5f205d163
SHA256: b8984acb419b90aab0f7fd9addaa90b10847e75aeaabfde74fc133085adf3455
SSDeep: 196608:Yu6eDsIwHBL4B9lCzT2bOgcDuihGYrLpVUBJ/7HAFGtNy6aMhnRTU+:WqsIwHNB26gVE7e/7JNMM5RTU+
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: d36073fe91a52f9a91536749d036ed16
SHA1: 4fef859a4c4def417eda442266c6de0ef11f13d1
SHA256: df8971fc8804ecbbb85f6232be3007de1ab7c1dcef31e89742180c73ad6d6f68
SSDeep: 24576:8oiv38Oa+4yoZbMB5AMnXXoUKSmbj6JmvRn3fJ2fcMuS:8fzFoxK7XXocmy0YkMZ
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: fa8ebf3570361ad33eb69b7ca050c264
SHA1: 44ead6299908a94ea242da2277e971e51bfb37ca
SHA256: c7fd11772d1886b7919807e3c6d98dc4819c2b4981ab602275effd9c6a784de6
SSDeep: 24:o0Xp8+cHyCDz7aVSK62sqmnlHs2oAJq9InzcmH6a1RYpjhHNAjpWd9lA:oCp8ZHLac52To9s2oAJUycmH74tAUlA
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab - Access, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 3d0e1f18676626331ffefafe53b18248
SHA1: 80d370bf723a4b00b769c1a7266d63de82280ab0
SHA256: 9ceac29cec7a9772266c3c6ed68bc7f25dcb38c12c388fe9f21e58890e9cf26f
SSDeep: 196608:PFNUxdiOm1j3/abCsYwFOSQo2pWDOQs4hW6s63HS:qPmN3/abtYIQoROQ93RS
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: f72cd2d77f45aa041cc9b46c23ccfa9b
SHA1: 83703ee03e71b86c9b94552f1b5f33d3dc9d62e4
SHA256: a9f155ff077518f754f9915317422812111ab3f482659d5d37cf3f5ae47e41a5
SSDeep: 24576:7kp03ZvTteq1dsIdzyzfXsrpMjOcbwW58tasRq09u8tKox:7+03zeXCMsr9i+a1Iuc
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: b9b64b30eb6545a72ea2d1bc92aa95d4
SHA1: b20c48f5eba79b1b908b85a5232682434b7497b1
SHA256: d80135c43cfb2479fd6aaad5ec9bb232be16402ca6e9e7b49606555ce6e16a90
SSDeep: 24:WFTEWofEJ/M5A+J460R8ZXpF73IT1OOkweu1rXOA+OavbOI9AU3kLAbsapWd9lA:w/z/Mq+i/R853IT0wx5avD9K0bs/lA
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 4660e5e0d73f8022ff623f5567873f0e
SHA1: 1de8f4e8002a8b6545bf8073abdb9bd62ea2a4ee
SHA256: eb85704f48fcb48bbd0bf89c7bc0c584334471e542e8172ac9e0d61525afc805
SSDeep: 24576:uOnx29m9QqG4cmOOdepR08HVZNRigtH3umDpfyicjA:uqx2AaqGAOOdUR0UxR5B3umDpGM
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 193e10c73df42e67ae310c0820052d65
SHA1: 8c22f5cad3e138028b535bc149d37d52333bf65b
SHA256: 55228b3d020254f3ec8fa0f397b017f1605a0e8c9aae25b2e9b3774de661ee79
SSDeep: 24:SjQvVg2FUt6xveIjMDGSCAk3qhO7hWo1Q2ypWd9la:s+Ret6xve0IG6StWoO2Xla
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: fa75de0002284aeac7dae471b6d679c8
SHA1: 16649339f75137c7ef98c009be901c654b0aa1a8
SHA256: 40f2a8d05ea6b44a5b334a45905f305262e68d4c0848e35cbe3fce3ff6fffd6f
SSDeep: 96:G3nYA1jiC0ONXKiGk2FB8ufyXnGXCn7vHQKu7ILpjgCFerSbdAQ6:PSjvNLngBNcoCnbwJclh42Sb
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER MD5: fce7247895fd6156ef16f30efcff9fd3
SHA1: dda73e5a9a50d2357801c2bde93f057ea658e19d
SHA256: 6c4e6c48e61e78ada64512fdc995fbaf7e0e0e5ac28396b943167084e14218df
SSDeep: 24576:FhdN8RKbJPFWRRms5rQlkXCftZpzIW73JUN:jdNRbJgTpQlkX0XkSUN
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: d475df2d77281eead86d6d4b9d680d8a
SHA1: a6a2959495e7ba7fb30eb52a0e2b86a0020464ea
SHA256: 7a7d6898edef465eaa49b15a4ff381670618e87a38c6cfc7973064909a8b10ba
SSDeep: 24:JbiUXD3oRIMSCt8D1lecHa2W5+9PqAoWq6h7dtYpkkgcvRl3d/jdok2lemcFpWdM:J2UzUIMtS1Nykq6NdzpcvbdRo1exWl8
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: cd91bbb2814f85a02c94404c92a68b11
SHA1: a565e7897c2aae2ba7ff8d1ee88680299fe693b6
SHA256: 427784bda24b9cd73b4ef53b2940f8ebfafd27e1d958d65d875bab480ea50a39
SSDeep: 98304:zDMUwxyODPFhbY12HLodiF4+5rivqk2wy8NAhv:z4UwVthio4iJwy8N0
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 459b8fd6587ec29c2793a0e7953c1321
SHA1: bf199ee4c1ca564a9f483a93983d650eb1b16b91
SHA256: d8068a0f46bed6027a2650fc6b1fb063e63b88eaa8c01ce1c4360f339c6ef081
SSDeep: 48:tJ1Bcyl0a3Sod8MXC0YUy/HIGpxQKtl/BYIuXUNzo7lq0+oG+ROKdP4CJ2lsllA:lBcyviMShpxQA3P+0KaCclsl6
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 52565d61713eb85013a2391d497a3f47
SHA1: a95bbf3a149e577114490960b0e09d488ca29d78
SHA256: 5d859fc00e09dbebac9809b009b34ebb0f1302f9f7e96738c943aa66a28773b8
SSDeep: 12288:oJ8DOp5OZKel2D/3cFTU4D/iB0QN0YYp06hSjR68:C4OpUKelCYTtDq/xYpl8Fh
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 5852ea046cb947272bca4c516448a0a9
SHA1: 54284e8b99c14f735fefd4ed094ab1a210b52e97
SHA256: 13ff10678548b65f330e79d382d5748083239146327122ed8182a47f90780026
SSDeep: 24:21frtPpd+z+rw+cGA2O0DvK5tytU3b5Aec9hSobEql3KbejhpWd9l8:Uf5pd+z+ioOtyt379hSob0beWl8
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: a10d3d4e71951039b09e5a42028b2a4b
SHA1: 6b120c0166d9ef7341a62af385a085ab055cbad1
SHA256: fe287933500e4beec5c215f1807b710ed276abfd8e082b79a40bfd5eefaf1f2b
SSDeep: 48:5qr1/zj7GDvS5PlDwQyRt4YL/iQyfJ4pf+1u4cxrCHFpSB+9RdlA:5qr1/COlRvI5L/iQi4tTP0HmE3d6
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: aa9637422bdb05d687ad228b579d3fb7
SHA1: e4c67d22495c34f0348b903b19ad02f9325797fe
SHA256: b205e4cb5dbe77754b0f864257b38c33a0233367972e683274da2baf4c8f27dc
SSDeep: 192:hOwHE4QiWGL2prLT+0/8q5s/1HyfcgC/WmZDCO:3tR8vcq5M5yfo7DCO
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: e223b9622140816165ea015f82a279e0
SHA1: 2809d0fa6cf1f7f6f179b2875ef926d116866087
SHA256: bd54cb6e25fa1b66995f7e6901b62fd21df3f5f5027fd41608c8cfe7e5b393c4
SSDeep: 192:Lw/hfDlffjCU2o5t+EPcGbjVza1aMJ/jzeAUgh:LkhrNbCUIE0GFza1lJ7zP
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml - Access, Delete
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 342f5e1371fcea69ff62db02168eef4a
SHA1: 12511011523ed3f53af25cd7ee3d2ee19958d46b
SHA256: 5f3f20b4ef5aa0ca7099236d3eba38ad8fce5cc945c1a352a16ccc58c9c07382
SSDeep: 48:cCTKgAPjXVeBDSLGYfex3dgzHNMn/Jesllu:BOFjfrffHm/JlM
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: d839f4f51113269ca08a88d6281893d3
SHA1: 62c14d6192d248441c0f1c280a099dce555f6762
SHA256: 8d3a02efd5aa1b3eebaea6007bf6b35332438ae4e966259c10a11892a4877496
SSDeep: 48:E2WofH4nhbqb0eJalYwHZUncvnU0FQxxgZgEFLuJjOlA:mofHgQQeJalbKncvnQxxeTENO6
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: e5ff36df3bb0349c92a939f388ffa70e
SHA1: f7149959ea4db0419130ddbd91bccd4d3aa38fe5
SHA256: 8d51631db1f7c8fbf522876fd9dfc55bc9c2c7ba2da3fcd6be4e7c7720f72d8a
SSDeep: 48:onvzOnSrvFsW2mH/5MlhZ1b5oBNkVpXeFlu:onvCnQviW2QkhZ11okpUM
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 48f00d61da74feef01e5ede83c683793
SHA1: 05ead7f8817a8b4daa2e8739349b9139240c7eb8
SHA256: 260d85b1f5ea81c692a4a064327f2a0447a3647ea146153a282185f5554505ab
SSDeep: 48:22BgGlprRODvUaty2k+Yi0jS3sSevS1lA:jJR6vUatys09Sx16
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 37bde0a53672a2b5c52b058aadbafa77
SHA1: e7670b6bf50b8dfcceb83164aba78d8533d4a703
SHA256: 6f203c134f1cf9fe9305202eac1159a80cfe2c604d5e56f3988c81f8fda6aab3
SSDeep: 24:e3S12pvB5Vc9BiDxsQnX2xLpS3HINtglfGE4yyTZmf3bfeQxpWd9lY:Ms2pvJH7Xw0uKfGE4LurfejlY
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 89694cc69bc9269a9048e982018a1d31
SHA1: 9a82b82fea4cbc9318a8275ebb9503db78dad6d1
SHA256: 4db8d83c1326aefaad628f3ac8ae783c7ca827d8d26e22ccafdb0fddfde08fee
SSDeep: 24:sX8UYgdXtYN2CbTaO+VDISEEZSeunS2T9nMfUUsduPcgxLTRWioW1s2pWd9lA:OsE9YlJwkSdZSe0v9jPy7J2jlA
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: e894adc5bb537223e14ce1dd97876a70
SHA1: 977e73c061302a356594b4252aab6357e57daf7d
SHA256: 545bda2d594701429f4c8288011592a70fa0c1fda77eb5fbe9e7f787210b08d5
SSDeep: 12288:kqYRCP7nVNL9aeJ1l/5JJ11GxsBYQDbm7ZNEI/CyTaL3A5VDRxH:mmnVTaeJ1lRmx0OfEuCyH5Fj
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE - Access, Read, Write, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 25679ec0bd86cd886bcb3343e8fc3675
SHA1: c9d61fd8b9ac37712f7bdd49bd71a15e35b5fa69
SHA256: 3c799e87a0db5e5c0ff07aa1c782014bdf447198abcfeef30ea24c89a9fa1657
SSDeep: 96:9nEb8NiVlniXzFVwLigq+UBQdFP+jF6LgD84FaGCdlWyZxoZjzmsi:968NqijFVGigqRBQnPJs9or4zG
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: c0e00da3d2942a6bd4f060ec01a895d2
SHA1: be903e6a3e84200abd0e9e2c8746bf5297e7875d
SHA256: 149bff5a349a2781ea6a3818d09002c4e3354baa28412f128daf476a90d7545e
SSDeep: 24:KLRE8y70r2fDMEH7QBG+6kga1nUgMpoG1FapH3EJt7pS2UWpWd9lS:KlENI2rMEUBGunUgMxolkS2UlS
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 9b69270fa99b0d3c233435ddfc364eb2
SHA1: 17e9cc13cd804ce319b8bf9938dd6a6df68ddba3
SHA256: 3e6b442c8c1f9b4b0e94dbda24c45756f3bfc2512862da27d7e692814e5b3ca0
SSDeep: 768:VMBFZzYNAfjWbJFQAvyockFKJX4hNRhfdxa:VyYNejWNOIyockFsaha
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 33da027ccd2b87dd28d0b69e99d3dba9
SHA1: 58d1f44275f11a877e4f6582d2f7f211802835b0
SHA256: a29faad4de68ab7775b6f659874217939fed9fafaaf8a5dd6c9172959f91eb3f
SSDeep: 1536:q/teIHP/IPLAbWrIJiC0Sm7JUIWAy7ZoX5y4jeb0ctiO:q/YIHP/IPLAbHhbm7JnyKnjcQO
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: b731c6544b608afc4583df268b1c18be
SHA1: 6fbc4dcf88488d653b7e1acedbb52ac5bde9e490
SHA256: cd714f245aa7814ff57d463cd2d46cf80836e8ad260bf0aed49284cb48955fba
SSDeep: 192:w5T3+s2Gy/3f9nl1fSiB6G4VemDz0LeSMpPO1uABs1:wd3kLZw3Dz0LBMp0Hs1
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi - Access, Delete
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 5f74e68b814eebc0210ec210ca3c7992
SHA1: fed2f70d6811f6bb464b93352e00e63d6acdb004
SHA256: c53c442928727fa49deb0d9b4cf5c98caa58e8132c9c5145a98403cacceb3dee
SSDeep: 24:mKjZ4ADyjBg5bC24lqJrFeGy81EZhALogWJHhm27WALg9Sjfp99xFQWSeYbpWd9i:mKN2K5mt4JoK64R277nx6eYMlY
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab - Access, Delete
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 724321318d87ba6a7d953e419ea92f8d
SHA1: db928bd6d5139031234cd822bea1743350d37c7c
SHA256: dab46722d3cf5dcfa975128207a93eb17a2fe3d008fb5b4ca39bb96de51ae17c
SSDeep: 12288:NkJdImbFvAnKE9BLAiOIjKN0de9MIurY/zoKwn+07x7xR1r9cB8JnpGrAaY:NohvnWlOIjy0kCnF5731R48CrtY
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: b056429aa6f1777879bf540ba0e652a0
SHA1: 3802ea5485435a8d68a2bb1d57c07729bdac7c91
SHA256: 025e0688329e14a91877196b14c49511c9e3a340dd0dbd773c6957abca888d24
SSDeep: 24:amxDPa705rKSRHvlVuHGnj1Pt3SQp/AJnFir4WS255pWd9lS:amJPa70RKSRH9VKU5MQGFj28lS
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 30ea72272dec1d5f30c4c4e0dee83916
SHA1: 4e5f7fff178f1f3357522d4844273f53681af963
SHA256: 4248d661c1391920a07dbce3dba7b21e5a0dcef0158958a28366ac9e507d8be3
SSDeep: 48:ofjYitEgFKcRAStSpugGGKzn1Roq/CkfCSQ1IU0Kgd6AzamQeczdW+IrqfA0IYlA:ofjDrFKLSt02PDCQC16BKtASFzdW+I+m
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: c06190eeb1c888bd9c73be2eec71d1df
SHA1: bdf81251feaffe0142bc10bbdba462300584924d
SHA256: a1004c085bc0b0ced90dea93c1723906f869ca4319fa9c88aea8472e1972a90d
SSDeep: 96:Qs26D5CgGuYDjQWC2gwmYmqwcODHJB00ewM:b26DyuYDjQvmRmVb1ep
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll - Access, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi - Access, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: a3ed16f645c6f74d9e61a54c4ffe85cb
SHA1: 8b3b78feda1acc4c9032047ecaec7227587ac148
SHA256: 1b0ad1aecdfe326c657ee3ed54547ace1ff3a2e0667f1c67266bf38ae37d4e13
SSDeep: 384:/XBP3nedtkkcIskVYsVDbhzJSyHL2np+ZDGw:fBP3nhIBPxTVopSZ
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab - Access, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab - Access, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe - Access, Write, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: d15c9486e7fd1e734e282ebabd7f527a
SHA1: ce80225143037f3c43d69a7a9cbf2a652465eacd
SHA256: d149d2b4b7781e87a5c8a1dddeb8615030576734e2c46f45784fe5ac1c21a5e6
SSDeep: 768:Rp6rFrlosoDNCFWQeth/Xl4u5m50CrftShINmD64uC:RpyVlosodJtRqu5mXfGIN6uC
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 0af1b4454592a0ccdf7f9415efd1dbf5
SHA1: 06cab895c3c415ca1f6b5df96afb25b7f7bf07f4
SHA256: 3cf126cfdb8b6a5fb995fad45d196815c37df2cfd374eb924756db1f84b362f9
SSDeep: 96:jAuW/U2qnCguZJmf1kyMqPlVnWfAf/dprFAqg/OyLkaLc2SCHx0KM:EuWWn+ZCkyMFfY/Sr5LcRIu3
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe - Access, Read, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll - Access, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access, Read, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Read, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi - Access, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 9d76e94dd0e44e2baf469ab2188b3a78
SHA1: 80f2193bb5eb2bd353c9f1396f31877d0c150cc3
SHA256: 9de00881d4c1c32feb4f088d35a43db87f31727c3cdfe0524cd2b4410b5b49e8
SSDeep: 192:eRfdgQ0yr+jPjJOJsBriAqSX0eRnTKktvjCH:q2tI+BiAjEeRT3q
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab - Access, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe - Access, Read, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: a2a665b594cd42c7a5c8ce27869ddfd8
SHA1: fc21f6dc7495e4d71b8bb5505d6258a180f63590
SHA256: f829c5813fb6d23645a6d7b6433ff30ce82fb2cf7e373a85007facdd33ed988a
SSDeep: 384:5yMSJFck07iJIY61KYx8P+kHhK7cvFNu8cfzzrnhh:5yMSJ+k8i561Tx8P+kH87cvHqfXDb
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 66a6e4cad82575792852335a9e6f43c5
SHA1: da16274ec7c7f604b0ba9b87fb3161031ff71743
SHA256: eaf09e1b735c707919cceed42cbb5dc93e753751a0db967c0b640cc6b325a460
SSDeep: 96:4yXcm6DCceufYP05tIou1VMIHvna4PPFiR9NM:4ysmTuYM5tiVPva4PT
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll - Access, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab - Access, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: e68eb6ab0771a96fff80389840481147
SHA1: af9184ef91b025066ef676dcfc8df262e7e34ceb
SHA256: 6b958c7edb50c8809c80cc60deee4c14ceece82d9a36823d9a9aa41ad3387e19
SSDeep: 384:FO2LuqPGIgG/Y0Hq+pakMEr72/kxkO7ZVYAq5mmWSzYuTiZcQQn:vDf/YOqA6E2Cxm3vIW
ImpHash: None 		Access, Create, Write Dropped File
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab - Access, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi - Access, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml - Access, Read, Delete
C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 5e88dc233efd721e48a72c03d7de4d28
SHA1: 59ba8dab9110a0afecd0e2bd95e85fa6bd08beea
SHA256: 5f8d7f1e9d29ece3383c5fa241cb8c8197a6ccae0b786c40d666792632b1bf30
SSDeep: 192:OvTRepQMH2rifZ04zzdGkl8BIGDliUhcG6qEif:OUpQMH2mZ3zdw1liU6G690
ImpHash: None 		Access, Create, Write Dropped File
C:\pagefile.sys - Access
C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL - Access, Read, Delete
C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\extensions.exe - Access
C:\Program Files\Common Files\extensions.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\GIFIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 563490577a6313df38bd0c2f3a10fc91
SHA1: c44931a91a88e7489790991283f4acaf7ecb189c
SHA256: 95d113fc43d52875e865e485134ef84ae7cd1965ff282905dea98351988a15c2
SSDeep: 192:1tqlzAJXroStGIV9ALaw0/a1g7SKWqnkxgWFA+tCgp9tPnUAf8xz+6tUdu3IUYUZ:WA3c+9Umeg7SWnkuQtFtPUE8iu4rNE
ImpHash: None 		Access, Create, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[admin@spacedatas.com].ROGER MD5: a3379cad4819e9ab3c7d0522a874960b
SHA1: f56124d5f3ff1744509ba7eab933d9f099597a2b
SHA256: 7b1a9ba67d9ce416a724a2ba7000d59bb1ea7735c7bb7f306a89461aa002c9f0
SSDeep: 24:kTzFOK5gGrb1LSqGedqcH1CXlitwjD2kENzP73pWd9le:yOCRrRSN28stwj6xKle
ImpHash: None 		Access, Create, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 2171a26f1bd467f0444f526ceca4cc66
SHA1: a3c3da441b0cb68fe3222db5fba112f42ffbe701
SHA256: 2dab306325356ca02d44b9f67a396cd84ff62a0002424141102f0817931ff102
SSDeep: 24:VgHV3wP5upE6poRl7oAWkbbCyV76kzaUhgJ2etpWd9le:+HrE62kAWkbbXJzat2fle
ImpHash: None 		Access, Create, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 11b0ed0681b78fd0ac321e74ac7ce1fc
SHA1: 99ddee2d35e58052dd3189fe3d300612b1d5fb75
SHA256: fd3bb6acaa25966bd049b1a4dfc1d6f531da36d9845900565dc1f48b5572c5ee
SSDeep: 48:dymm0Zg0FslawDosmt0699HkhzaaqyYCU3qhPDk2le:00ZdyL2rDHKaadsaRp8
ImpHash: None 		Access, Create, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.WPG.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT - Access, Read, Write, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\WPGIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui - Access, Read
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui - Access
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe - Access
C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui - Access
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui - Access
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui - Access, Read
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi - Access, Read
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi - Access
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml - Access
C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui - Access
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe - Access
C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.id-9C354B42.[admin@spacedatas.com].ROGER - Access
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACERECR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ADO210.CHM.id-9C354B42.[admin@spacedatas.com].ROGER MD5: 865a1b94163a97d81d4b424ef53cd9ce
SHA1: 242a2a72b0313b8ad8ab11387d9c99924da576a4
SHA256: 4b08451e13fb41add6efd14576b3f62a952d6ef4685b742c4239265e35bc818d
SSDeep: 49152:R0opH/cgHa3HRxz+4g6QWWC+uFKMizmd3DolFnh:R0op1Har+LNlMoeoh
ImpHash: None 		Access, Create, Read, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[admin@spacedatas.com].ROGER MD5: b7ec1f0823b355b2cec7260f7aa6ad21
SHA1: 5915d8524bed6a5384ca3b231f9fee950bfbb81c
SHA256: 92526fdf04cf913f0ebc83a838338cc35375c113560008331faf7e334e183dbd
SSDeep: 48:xq52honvM1ZH1tpWyUlS4GKGUIIQ6FSpo6e+CFy4WDPuC3OShoySJlW:xk2meN5/lGInDppeByDjerywk
ImpHash: None 		Access, Create, Write Dropped File
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEDAO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEERR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODBC.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACER3X.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACERCLR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACETXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWDAT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEWSS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL - Access, Read, Write, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ATLCONV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll - Access, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Read, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF - Access, Create, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_PDF.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE - Access, Read, Delete
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE.id-9C354B42.[admin@spacedatas.com].ROGER - Access, Create, Write
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\IACOM2.DLL - Access, Delete
For performance reasons, the remaining 753 entries are omitted.
The remaining entries can be found in ioc_export.txt or ioc_export.json .
Registry (26)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContinuumLoosely\Config Access, Create
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ContinuumLoosely\Config\IP Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ContinuumLoosely.exe Access, Write
Mutex (2)
»
Mutex Name Operations
Global\syncronize_20BAM8A Access
Global\syncronize_20BAM8U Access
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image