Program did not start
General Info
- File name
-
LockerGoga.exe
- Verdict
- Malicious activity
- Analysis date
- 4/14/2019, 22:21:00
- OS:
- Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
- Tags:
-
ransomware
- Indicators:
- MIME:
- application/x-dosexec
- File info:
- PE32 executable (GUI) Intel 80386, for MS Windows
- MD5
-
e11502659f6b5c5bd9f78f534bc38fea
- SHA1
-
b5fd5c913de8cbb8565d3c7c67c0fbaa4090122b
- SHA256
-
c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15
- SSDEEP
-
24576:645Rt4El7fc/TFJzjJUgrrCq5sNIwQsUGy1q7a9DlIACTp+kqGslRG:Rjt4El7fc/TFJWstwQsPdSDuACTpqhG
Software environment set and analysis options
Launch configuration
- Task duration
- 300 seconds
- Additional time used
- 240 seconds
- Fakenet option
- off
- Heavy Evaision option
- off
- MITM proxy
- off
- Route via Tor
- off
- Network geolocation
- off
- Privacy
- Public submission
- Autoconfirmation of UAC
- on
Software preset
- Internet Explorer 8.0.7601.17514
- Adobe Acrobat Reader DC MUI (15.023.20070)
- Adobe Flash Player 26 ActiveX (26.0.0.131)
- Adobe Flash Player 26 NPAPI (26.0.0.131)
- Adobe Flash Player 26 PPAPI (26.0.0.131)
- Adobe Refresh Manager (1.8.0)
- CCleaner (5.35)
- FileZilla Client 3.36.0 (3.36.0)
- Google Chrome (73.0.3683.75)
- Google Update Helper (1.3.33.23)
- Java 8 Update 92 (8.0.920.14)
- Java Auto Updater (2.8.92.14)
- Microsoft .NET Framework 4.6.1 (4.6.01055)
- Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Professional 2010 (14.0.6029.1000)
- Microsoft Office Proof (English) 2010 (14.0.6029.1000)
- Microsoft Office Proof (French) 2010 (14.0.6029.1000)
- Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
- Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
- Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
- Microsoft Office Single Image 2010 (14.0.6029.1000)
- Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
- Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
- Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
- Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
- Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
- Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
- Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
- Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
- Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
- Notepad++ (32-bit x86) (7.5.1)
- Opera 12.15 (12.15.1748)
- Skype version 8.29 (8.29)
- VLC media player (2.2.6)
- WinRAR 5.60 (32-bit) (5.60.0)
Hotfixes
- Client LanguagePack Package
- Client Refresh LanguagePack Package
- CodecPack Basic Package
- Foundation Package
- IE Troubleshooters Package
- InternetExplorer Optional Package
- KB2534111
- KB2999226
- KB976902
- LocalPack AU Package
- LocalPack CA Package
- LocalPack GB Package
- LocalPack US Package
- LocalPack ZA Package
- ProfessionalEdition
- UltimateEdition
Behavior activities
| MALICIOUS | SUSPICIOUS | INFO |
|---|---|---|
Starts NET.EXE to view/add/change user profiles
|
Creates files like Ransomware instruction
|
Dropped object may contain Bitcoin addresses
|
Static information
TRiD
.exe
|
Win32 Executable (generic) (52.9%)
.exe
|
Generic Win/DOS Executable (23.5%)
.exe
|
DOS Executable Generic (23.5%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2019:03:18 10:07:54+01:00
PEType:
PE32
LinkerVersion:
14.16
CodeSize:
950784
InitializedDataSize:
322048
UninitializedDataSize:
null
EntryPoint:
0x9d54b
OSVersion:
5.1
ImageVersion:
null
SubsystemVersion:
5.1
Subsystem:
Windows GUI
FileVersionNumber:
1.5.1.0
ProductVersionNumber:
1.5.1.0
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Win32
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
Neutral
CharacterSet:
Unicode
CompanyName:
ALISA LTD
FileDescription:
Background Tasks Host
FileVersion:
1.5.1.0
InternalName:
tgytutrc
LegalCopyright:
Copyright (C) ALISA LTD 2019
OriginalFileName:
tgytutrc
ProductName:
Service tgytutrc
ProductVersion:
1.5.1.0
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
18-Mar-2019 09:07:54
Detected languages
English - United States
CompanyName:
ALISA LTD
FileDescription:
Background Tasks Host
FileVersion:
1.5.1.0
InternalName:
tgytutrc
LegalCopyright:
Copyright (C) ALISA LTD 2019
OriginalFilename:
tgytutrc
ProductName:
Service tgytutrc
ProductVersion:
1.5.1.0
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000118
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
5
Time date stamp:
18-Mar-2019 09:07:54
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Sections
| Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x000E8032 | 0x000E8200 | IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ | 6.65764 |
| .rdata | 0x000EA000 | 0x000346CE | 0x00034800 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 5.00574 |
| .data | 0x0011F000 | 0x0000B6FC | 0x00009000 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 4.906 |
| .rsrc | 0x0012B000 | 0x00000508 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 3.71326 |
| .reloc | 0x0012C000 | 0x0000E228 | 0x0000E400 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ | 6.55487 |
Resources
1
Imports
SHLWAPI.dll
NETAPI32.dll
IPHLPAPI.DLL
Secur32.dll
KERNEL32.dll
SHELL32.dll
ole32.dll
ADVAPI32.dll
WS2_32.dll
Exports
No exports.
Screenshots
Processes
Total processes
95
Monitored processes
51
Malicious processes
2
Suspicious processes
0
Behavior graph
–
+
Specs description
Integrity level
elevation
Task сontains an error
or was rebooted
Process has crashed
Task contains several
apps running
Executable file was
dropped
Debug information is
available
Process was injected
Network attacks were
detected
Application downloaded
the executable file
Actions similar to
stealing personal data
Behavior similar to
exploiting the vulnerability
Inspected object has
sucpicious PE structure
File is detected by
antivirus software
CPU overrun
RAM overrun
Process starts the
services
Process was added to
the startup
Behavior similar to
spam
Low-level access to
the HDD
Probably Tor was used
System was rebooted
Connects to the
network
Known threat
Process information
Click at the process to see the details.
- PID
- 3032
- CMD
- "C:\Users\admin\Desktop\LockerGoga.exe"
- Path
- C:\Users\admin\Desktop\LockerGoga.exe
- Indicators
- No indicators
- Parent process
- ––
- User
- admin
- Integrity Level
- MEDIUM
- Exit code
- 3221226540
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
- PID
- 2736
- CMD
- "C:\Users\admin\Desktop\LockerGoga.exe"
- Path
- C:\Users\admin\Desktop\LockerGoga.exe
- Indicators
- Parent process
- ––
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\desktop\lockergoga.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\cmd.exe |
| c:\windows\system32\apphelp.dll |
| c:\users\admin\appdata\local\temp\tgy |
- PID
- 2684
- CMD
- C:\Windows\system32\cmd.exe /c move /y C:\Users\admin\Desktop\LockerGoga.exe C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Path
- C:\Windows\system32\cmd.exe
- Indicators
- Parent process
- LockerGoga.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Windows Command Processor
- Version
- 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
| Image |
|---|
| c:\windows\system32\cmd.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\winbrand.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
- PID
- 2188
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -m
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- No indicators
- Parent process
- LockerGoga.exe
- User
- admin
- Integrity Level
- HIGH
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\logoff.exe |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\samlib.dll |
| c:\windows\system32\net.exe |
| c:\users\admin\appdata\local\temp\tgy |
- PID
- 2892
- CMD
- C:\Windows\system32\logoff.exe 0
- Path
- C:\Windows\system32\logoff.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Session Logoff Utility
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\logoff.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\utildll.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
- PID
- 1356
- CMD
- C:\Windows\system32\logoff.exe 0
- Path
- C:\Windows\system32\logoff.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Session Logoff Utility
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\logoff.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\utildll.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
- PID
- 2196
- CMD
- C:\Windows\system32\logoff.exe 0
- Path
- C:\Windows\system32\logoff.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Session Logoff Utility
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\logoff.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\utildll.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
- PID
- 1152
- CMD
- C:\Windows\system32\logoff.exe 0
- Path
- C:\Windows\system32\logoff.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Session Logoff Utility
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\logoff.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\utildll.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
- PID
- 3384
- CMD
- C:\Windows\system32\logoff.exe 0
- Path
- C:\Windows\system32\logoff.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Session Logoff Utility
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\logoff.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\utildll.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
- PID
- 1464
- CMD
- C:\Windows\system32\logoff.exe 0
- Path
- C:\Windows\system32\logoff.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 1
- Version:
- Company
- Microsoft Corporation
- Description
- Session Logoff Utility
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\logoff.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\winsta.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\utildll.dll |
| c:\windows\system32\setupapi.dll |
| c:\windows\system32\cfgmgr32.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\devobj.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
- PID
- 2996
- CMD
- C:\Windows\system32\net.exe user admin [email protected]
- Path
- C:\Windows\system32\net.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Net Command
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\net.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\apphelp.dll |
| c:\windows\system32\net1.exe |
- PID
- 1244
- CMD
- C:\Windows\system32\net1 user admin [email protected]
- Path
- C:\Windows\system32\net1.exe
- Indicators
- No indicators
- Parent process
- net.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Net Command
- Version
- 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
| Image |
|---|
| c:\windows\system32\net1.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\dsrole.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\samlib.dll |
| c:\windows\system32\ntdsapi.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\netmsg.dll |
- PID
- 3260
- CMD
- C:\Windows\system32\net.exe user Administrator [email protected]
- Path
- C:\Windows\system32\net.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Net Command
- Version
- 6.1.7600.16385 (win7_rtm.090713-1255)
Modules
| Image |
|---|
| c:\windows\system32\logoff.exe |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\conhost.exe |
| c:\windows\system32\net.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\mpr.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\apphelp.dll |
- PID
- 2976
- CMD
- C:\Windows\system32\net1 user Administrator [email protected]
- Path
- C:\Windows\system32\net1.exe
- Indicators
- No indicators
- Parent process
- net.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- Microsoft Corporation
- Description
- Net Command
- Version
- 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
| Image |
|---|
| c:\windows\system32\net1.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\dsrole.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\logoncli.dll |
| c:\windows\system32\browcli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\samlib.dll |
| c:\windows\system32\ntdsapi.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\netmsg.dll |
- PID
- 3792
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3852
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 1184
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2716
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2432
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 1672
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2388
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 312
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 1708
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3636
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3228
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3412
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2616
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3212
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2888
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 592
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3740
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2748
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 476
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 300
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3056
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2148
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3316
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3072
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2532
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3452
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2584
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 904
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2688
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3324
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3628
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 1100
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Exit code
- 0
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 2264
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3284
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
| c:\windows\system32\msasn1.dll |
| c:\windows\system32\oleaut32.dll |
| c:\windows\system32\bcryptprimitives.dll |
- PID
- 3096
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
| c:\windows\system32\rstrtmgr.dll |
| c:\windows\system32\ncrypt.dll |
| c:\windows\system32\bcrypt.dll |
- PID
- 2384
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Modules
| Image |
|---|
| c:\users\admin\appdata\local\temp\tgytutrc5079.exe |
| c:\systemroot\system32\ntdll.dll |
| c:\windows\system32\kernel32.dll |
| c:\windows\system32\kernelbase.dll |
| c:\windows\system32\shlwapi.dll |
| c:\windows\system32\gdi32.dll |
| c:\windows\system32\user32.dll |
| c:\windows\system32\lpk.dll |
| c:\windows\system32\usp10.dll |
| c:\windows\system32\msvcrt.dll |
| c:\windows\system32\netapi32.dll |
| c:\windows\system32\netutils.dll |
| c:\windows\system32\srvcli.dll |
| c:\windows\system32\rpcrt4.dll |
| c:\windows\system32\wkscli.dll |
| c:\windows\system32\samcli.dll |
| c:\windows\system32\iphlpapi.dll |
| c:\windows\system32\nsi.dll |
| c:\windows\system32\winnsi.dll |
| c:\windows\system32\secur32.dll |
| c:\windows\system32\sspicli.dll |
| c:\windows\system32\shell32.dll |
| c:\windows\system32\ole32.dll |
| c:\windows\system32\advapi32.dll |
| c:\windows\system32\sechost.dll |
| c:\windows\system32\ws2_32.dll |
| c:\windows\system32\imm32.dll |
| c:\windows\system32\msctf.dll |
| c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll |
| c:\windows\system32\cryptsp.dll |
| c:\windows\system32\rsaenh.dll |
| c:\windows\system32\cryptbase.dll |
- PID
- 3644
- CMD
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe -i SM-tgytutrc -s
- Path
- C:\Users\admin\AppData\Local\Temp\tgytutrc5079.exe
- Indicators
- No indicators
- Parent process
- tgytutrc5079.exe
- User
- admin
- Integrity Level
- HIGH
- Version:
- Company
- ALISA LTD
- Description
- Background Tasks Host
- Version
- 1.5.1.0
Registry activity
Total events
3549
Read events
1749
Write events
1800
Delete events
0
Modification events
PID
Process
Operation
Key
Name
Value
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
SessionHash
1EAAC68BEF1ABE20406450D2EA76120923784B9266859FB8642161F7565573DB
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFilesHash
5938DCCEDD63A1230096B5B73F3051E7BACF56FAEEE37869D8B2443460C39EAC
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
SessionHash
3A0B1A0B5F86BEB8724CD47069C972EFCB75E47EF1FC295997FFD4F4555D52F1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32B.GIF
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFilesHash
D7C7FA853971F672BEFB0E7C94E8040C3374935B361C5E25DCE1E8963B832B9B
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
SessionHash
7F34FF5F0AF4B029928C4A56B29B982F0F9AABDE398CEC7060507B3B87988231
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFilesHash
5F94DECA72E95EE7BDA84FFE14C78DAD2F11AA3862AEC22DFB684C026159CF13
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
SessionHash
B59C2C6726CC53139CEE88F6E53F78576ADC41ABCABB1C1A9553A7773DF711DD
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFiles0000
C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.DLL
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFilesHash
3D86AC1C82E67AC63B1A91DBAEA2594646AEADA867726902BDD45F52AF12FAF6
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
SessionHash
EBA0C4DFB1C91C6A552C852B94434784EE3B6E308FA3E2014986F0B8B1D4A0B7
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFiles0000
C:\Program Files\Microsoft Office\Office14\CSS7DATA0009.DLL
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFilesHash
BE399122495FC07FD210739C7D694E2836C8790E22206FBDE38361C336E6E61C
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
9ADA829FD071FD0B6A832239E77672A166E782BCAB1A966092AB00852341D8FC
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDCNCLL.ICO
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
C0D7CCFA04C0816AFB2B0962DDF799E592820867FD675DAC707BBB1352F1AE86
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
E5B480BB6CD655199349E004372FE517D194812C9A74CBC02A98B1AEF9A18C9A
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\Program Files\Microsoft Office\Office14\GKPowerPoint.dll
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
2334A67319197DD8F4EA8228FC418A16A01C11FDFC8F6E571EDD5BC3515A1CF1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
SessionHash
341BF6A18C3D1DD81F40CCF563713B080837CCC61C4126C69195EE1ECD6CE8D6
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFiles0000
C:\Program Files\Microsoft Office\Office14\mscss7wre_fr.dub
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFilesHash
66F6E2FBF7D84954E749B784FA6987CB9187DB78F1E4AFFAA7D81A7049E105A9
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
SessionHash
7505EA8FDD3C7B0B17B629B5C7F99C658979A5EAB9FC9A25C0E9EB6C7D8E5807
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFiles0000
C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.NZ.XML
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFilesHash
E655E8535E35F2EC0888072541D2243CA3018619516D0EA479D5EA0CE965EEE4
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
SessionHash
B7D706EEE332DAB9F75B4E1653D6D395B909A101E4DB0CD2B5BFDD70C630DEDA
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFiles0000
C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFilesHash
DFF27D1AD79B2E39BC60A873AB7A940F0B5DC694BDB094EA7B09323DF69B6FC0
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Owner
E409000010AC58A9FFF2D401
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
SessionHash
163AC7E0CA43AB57DD18A9F36B94FE4ECB94B735D69F98D9D177B5CBB082A42B
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Sequence
1
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFiles0000
C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN002.XML
2532
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFilesHash
FFF25BF1FF57F9F89F104E96F01E4A646BA147E0E908E49A8B499FD9242F9830
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
SessionHash
3792C8F84BC1EF4F1234D43DC42B15CD22911F3289A31FC3F73029A3F787735F
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFilesHash
4229DA800407D064ABF58C9232B0F047E9E1D085F60E0BE4CBC8D175AB22370E
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
SessionHash
E85C62AC76441EB1E1DDD3E664FA2EE4681028CA7D504FC949A4FA3DA77B6FF3
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFilesHash
9415E3F905AF44D1D6EE98775BE3E1B665AB48A846D75670B73E7936F86DF2F2
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
SessionHash
1A63EB7AADD5D1C8499815FC6C3FF7B9269DDD8A1449D94E777DB6E415B6A6C3
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0009
RegFilesHash
DACDAE154F9451B9B802BA39FB8F105BDD6C185BD4DB04DF877832A8A4FC61CC
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
SessionHash
B69F50A3ACAC9941AE8DA7CFD09BE8CCA971AAA31AE85A49285995466C04CF42
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFilesHash
7F8AB1A1A2310D250C0872842E767F5156EBBB8B3681EE8C0F3A8CF89ADC1D29
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
SessionHash
7678228441CBE8FBC0AC891096E598C4884214B0313D18FEB7BFB09A635BA324
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFilesHash
C3FF3384EADC6CC03ECA5CA690340BB0C54FE1645888592750922C959B0E1C32
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
SessionHash
1562E7E5484A77304DEA569F39B936418DB3989D0DC48FFF8E08679E0B9C814E
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0023
RegFilesHash
D1B74809D0EB008047EECB9E7F39062CEC1B341E715858A85FE9C9678F8AF0A3
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
SessionHash
5B8142D20188563382FFE3573F2C06420E5649085F4464C4D2D7676EFD77500E
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SIWW.cab
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFilesHash
B1DF6FB66F4F0BD3EB57D6A6519586DF8A8CFAE44E0B497CB347C9EF480AE618
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
SessionHash
C66EB973B3877D572A160EB8BCC567172BE2CBCB5F25D77B7F00F6E855CF82AB
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0040
RegFilesHash
5E2AE91DD0CC46996BB1846696078A172DFB91C27A761F0D9996BAEC7DA1B662
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
SessionHash
072A11D2463413958B032EFC84DB7BF54E68250146ED27B29ED67F6CF887B96A
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0045
RegFilesHash
C9D14C10E61E03BD8DB5008B13D8DB207EC91BEB0D7D6452021DD1C32E1AC984
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
SessionHash
1176BF0D6C6DB1AFDF57B7D90E6A60F9D29B0E007B56BCE7827FEAE33E55EB4F
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFilesHash
85AD51CFD22F6D34ADCCAACEB86471ABDEDADA97E168A2900B59CD3F0B3FDED6
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Owner
D00E00006093189EFFF2D401
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
SessionHash
3D1C66477AB41D8694A7F6C4F75A8EF50A48355A723DD4B12D2D768ADE61805A
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Sequence
1
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\PidGenX.dll
3792
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFilesHash
6E9CF5339F3918780D1605066EE4FA04291D4CB20E3B9FFD8454767CA249BF98
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
SessionHash
A9B513BE4907AB9CD9819D7F9FEB4E987335D22BDEC3491EB347084979E0A431
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFilesHash
0742E12B64F22C74B48D314B5B85A3ECC411E3ECF23A7AA5E39DE4013F1B627E
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
SessionHash
19656A53B4F30DF8BA203B311B8AC55A1A0039E36B15EE6C4AE5DDE2FBBF71E3
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0013
RegFilesHash
093AD121129FB038D5EC95C3DDE6D5E29026E6D135E88252641B44B8EA91F1BA
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
SessionHash
C580F6030259D27CB25EA43304FFE46890D41290C23901E9D4F2628509B1F6BE
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0018
RegFilesHash
7CD458A5733BAEFFF697E8A3E6D6A5C692040E167C78F84FE934F02F5803B937
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
SessionHash
0D4AF1A54EC69833BB996C5B8941883256933E0AE3F074EF7927D5E906F5E069
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFilesHash
EC88B6154F8F092882F8AA862C767FA1D3B829D91DC9C07A93CD2C752B267FCE
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
SessionHash
B88B1128BE4CC025C596C7BC674F6513FFBC8A8FB9FB9C0DE367CBC9A1ECBF9C
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0030
RegFilesHash
A764B7F54591C790C545545B2A5AD5D43DA66420323CDC734F8C0DD02E3619BC
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
SessionHash
2F6095BF7767DDD109BDFB535982CF30C6895513802D59407C1D88ED724B6962
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFilesHash
87AD7BCE5B823E2AD3388852DE405E060D8D7AA5566E9D7513F43C19C31FD464
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
SessionHash
67543AAF56E656C4413E974F09192EF5FEEA5B83D02AEE8909D2FEA82ACF2FD4
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFilesHash
16CA44C2483FA0AA46B8C02139C71162F9EF867C7E4D70A3F1685347917EE6B4
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
SessionHash
1D27DBD9776E40D148D17C32661F3F09F99DCB54B80FDEADC0D92526CB98E64F
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0047
RegFilesHash
69D36127366709BC1815A98171B1A4D5617A718F25F406644FC6EC2115308686
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
E330065CA1361FC039875FF1844A28EF6D4101186C60318B7FF0818F3899B6F8
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
CBD4A7E5BB0C4F6FFC7620A9263619DC357B912232F4447839CB13E6EF7C98C8
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
SessionHash
023AD3E28E3D3FD012E4DA9D685A855E0FB8F432C7ECC06420B5B06057AA5F33
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFiles0000
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFilesHash
E51B31535C10ADEB0899BE09D6E11F071480D9517A1C511047E0D1FEC7A0A584
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
0C0F00006093189EFFF2D401
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
2F8E6E6EDD552AA294AF5853369ECB3BB42A374901F4C2DB4E0148A0723A305A
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\setup.exe
3852
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
E52100353468E91596191A7F4804B271D12C6E8C074C49620506F51BEE467A03
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
SessionHash
637A54033D334E0EF9E2892ECB85BB6605356749F7D9ACFF96D7CEF61FCAC250
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFilesHash
02EA62E2C6D2623E7EE1380F47E485A19138D02011EC7268048DA61A868F6D46
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
SessionHash
862055B352B04C03CF783863A7E3498D7136F3050A1AF040933E087486543020
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0007
RegFilesHash
F6D64812B3203FCFB66C84A357A2DB84A8E1DFCF9653C25A01041F3271758F5E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
SessionHash
FFA743C41BACDABA6484725108565104B7294BE28D98986EC5972703FF86809E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0012
RegFilesHash
A6186BA067F49F44D3DE16F07E7027B491C6C6C8CA454E92F938F6887D24BBE0
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
SessionHash
B0A45F73AD8F022AF185F2B642E91536443533420CA93E7EF0C5F5B41B916FEB
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SingleImageWW.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0016
RegFilesHash
578AFFE769A1039E14784DF9F705C50AE52ECFDD6D38F9F8A68966286510A6A5
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
SessionHash
2405510ABC2CC96B9D69A6C363497808936D4428E166E76A0A0203B8169B1E18
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0021
RegFilesHash
FC89A1AA43B42745FF8A75C503A8E7C8041B36AEFB19DB363717071DF9103B87
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
SessionHash
FAB6119BE1C53809E0FA4A3D67A14497B310EC74CDD7B730AB6AE826710103B8
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0026
RegFilesHash
0F3B596168365447F64F07332A8EB6348E2BFD370210337BFD7C9B4CBC0BC55E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
SessionHash
52DBDFD419D2E38D54D5C6B7DF430CC7E6A31A2F6441BCBAC2C05082D1965392
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFilesHash
AD6D7C05A1B0A444E8F95CA97CD667DCA967A07FC1E8A7F274C09898AD5F072E
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
SessionHash
B10CD5401E4FD1745ADDC4C914528D2A730FD9188CE191EAF6C2E7C48C9644C1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\OWOW64WW.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFilesHash
2B739F019EBE258D98D40D66591A4305C290B8E9A3BAB404923A68FF23C9F859
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
SessionHash
FED03208ECF7CD66AD4430F34A8564AD626E7B075CA86E6A38535506A57662E4
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0037
RegFilesHash
21E6E2D33150A9B3907CC19A4500899E9E374B1A6A612BC1C58748F1CD1BA309
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
SessionHash
20CF88821F9F65F12E57257D41B9B21FFF97033435E9605D7F0BA5190EFA9B30
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0042
RegFilesHash
49108677F43055A06DDBB17395E3F33D3449E43F6F309D7F51F729F4F78F7314
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Owner
A0040000BAF51A9EFFF2D401
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
SessionHash
15CA0AF77815681BA5B82E9901034AD1005608663E00418D37D25B4BC949A2C2
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Sequence
1
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFiles0000
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi
1184
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFilesHash
D6CACB9B3CCFAB0B6EE20914E23A26CF7EF17F7D7D4322B912E3C89DB819DC8E
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
74A6D384577FBD49D92C9801E5C4CFBC59ACD4982FB211C8142084BBD79B5C8B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
F12B21418071EB722D5B24C81FECBCFBA25F90398777D56720EEA8B3AD4FFD61
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
SessionHash
F1FFFC375D37DFF566A263EC45200ECBED11A24445705808413844B973DF414B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
RegFiles0000
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
RegFilesHash
FF2FE65BFA469120B89108FC168C6E2A9AF3E44A86772CCF5F4A3E492D602B52
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
SessionHash
BA5BEE29EAF451C18E8503179AD9F0258A8BB06F1839FB8A78382A15851A4431
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFilesHash
7B9FD59713B004907BE9B98E21C5A497EE291B2EA407A1C115AF5D8C3BFEA251
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
SessionHash
67679686B3FE63AF8E42518B2911E6E9913441E4CC8A9326AEA92888E8B5D8A1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFilesHash
9B4B1C274F91B6A60C057BF5D76175EE2198BEA1062442BA160173BB3C48D72B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
SessionHash
F8889C5298DEE25FF717979EA414A3E7E5065E75E3F04912A7B4EEAE2487AA46
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFilesHash
1A2E0A9B7D7C442B231A24B647DB4576C2DAAA334BCEEB4D239FBDF6FDD8819F
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
SessionHash
68E020CC93D67E1E00F2E960FE78BCFA063FDCE5B5BC4A9505CC37C20A1F6012
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Office64WW.xml
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFilesHash
05FB9F011582CB1A9CF0FEFE9385A8056767EA2C35170F6F525749CAB0985CA0
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
SessionHash
8F6D8F84D34168D6F1D10E52950C67B30C58334EDA1B4F8AD9E5E3606E6DB969
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SIWW2.cab
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0028
RegFilesHash
AFE8310B0F3E53CBB57218C2D1FBF136CE65FF05C421F5E93B97DBAADE5BBBC3
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
SessionHash
6970251F505DC666901B9EA04CED62B78E6F6AE4E5C82CEE93F15E916B30D452
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0038
RegFilesHash
38A07B458574181165E76DA5DAA673ACF09E4C536A86B346BB5A3D4CD58C9960
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
SessionHash
1EFA6EF58CEF61E28C232EA3ED13073BABFBAE26C7DEDC63CD0D039E37DB7C7B
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\osetup.dll
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0043
RegFilesHash
B194A2D5F2A6B7146D4C6DBCAF80F775E252F0B52388BF630A80A570624C9A7E
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
SessionHash
B9943A1740F034BAFBE21714DE53E0EEDFAB4687F64C7B3D3A7239919FA662FD
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
RegFiles0000
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0046
RegFilesHash
7CD71B04A41CED0CE4871458783CE8BC9F990666C36C16BCA4663F8292E940C5
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Owner
9C0A000014581D9EFFF2D401
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
SessionHash
7035CA36EEEE72BEA684CF352FFE62C9B64D93EDE93ACED23BB990F406740E8E
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Sequence
1
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFiles0000
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi
2716
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFilesHash
15BDF03CF669FBDED53FD2D9E155E75DB37A11D7B4DED9E681FCFE0DAC81B73D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
SessionHash
FDD6292A9972902FEAB138C6687BB105728F8413E8C917E37F0DA3C65A816804
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFilesHash
470312B6D8B627B5C8DAB0D3C63232BAAF021D45B8D71C5C7C13095C3C534DDC
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
1F68FA7B43489D8CFC1E7ECFB39B1CE2039C6271D90163BEBA9C073EA378CC41
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
0CB3215B032786F6D4FCF1E3963FCDA51477C5166A2D270BBDA2A9298B36AA5D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
SessionHash
43BF6D71F8D9BE334D86D23523EC31AA029EF17CD46ED18FA3B8A20E493DB77D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFilesHash
7C6D28A44288D7CF1CF9230C2E73801F022EF29B6AEEF831398DBDD707290828
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
SessionHash
8C19A4288B39BC1188CC9D82CA94EAB069244F34045E3820C3D21F55CB61B887
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Setup.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0017
RegFilesHash
15C767A6A75715A5E4F6B70283CA60201893AC907C8072AD364566FD1F8A0DD6
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
SessionHash
82B4D69A3F152E14DF0BAAB233D15780692331E032B1FB29742098979E46C616
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFiles0000
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0022
RegFilesHash
7D61B81AF261D114F247D14F3F38A36602778C80112FD910A1D2632DEB21917D
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
SessionHash
E007C6D82ED5D2B36C883E8CFCA8CC5309735E15374E14383548766AB89CE2B4
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0027
RegFilesHash
B1878833F4505FD35A76EFDCBAFB67E94337418E99E7FC86FF8C361CE5939BF2
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
SessionHash
4AC1E88DAE99DF3645D0D24FD08233A01BB0F378DD98A776011426498CE0C85B
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
RegFiles0000
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0032
RegFilesHash
30132B0BF32DAE15481AD91F6CE783362E5FC0C153775A0917410D13AC14E63C
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
SessionHash
16861937C80D221210CDE91751C14DC48FC729963F0821658DFA93A8C59FC125
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\SingleImageWW.msi
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0033
RegFilesHash
360C725A223AD11619F610538C8D29B03E751BCBD710D2EB62431CAF48792D7B
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
SessionHash
C70878C51A602353B77A5EFCFF10ED8AB6ACE95B72E5F4F4D988C5631B5A642C
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0035
RegFilesHash
63F6C304D280CFA4B4FA4983CA4FD115F0B3CFCFFC226F0261A505E587F4B331
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
SessionHash
6E88C58D05538C9A000FE4B597B6B15AB16D5A352057BD77C6642D5B5EC28F8A
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFilesHash
6C552025D7744E53A78AB95E993E15E6A45B948A1D93DF817B42B44C54763D37
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Owner
80090000C81C229EFFF2D401
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
SessionHash
7EF57B63641E01F9D211C705FBD34B41FD45136A5339AFC77E6859CA75144A53
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Sequence
1
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\Office64WW.msi
2432
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFilesHash
CB6304DC7656CEE55324AEF8889EF925D4C82043BED398DA33AB857B30FD27B0
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
SessionHash
F48F5604C5CDC700979FDFFAC162F44141A938E59B7CA1AB02C05ACE3DD0E507
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFilesHash
71C8709AD9F7800F8D039C0F3B7481700568272DA136EE3F4D261672CFABB8A9
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
SessionHash
5442868D88C1A812180A4C73C6A346043F4CD40B34885EB889449F71E4B52CEE
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFiles0000
C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
RegFilesHash
FB3C79A1EAAC970CCD67D34E08F5E38C1C743588BB3DAB30497DAD12E9C1A7E3
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
SessionHash
9ECA8FABF010DD74BEB7F782584E7B177015879C128D39A46D100318B1DFECA0
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFilesHash
F38FA0CC88056A90CA934DE3EB815FD185AF7FE0E22C520A60E152E7E4856E19
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
SessionHash
926320C957360D16F46B13B28F57814ECFB3975659C439980D002D581B76FFF5
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0005
RegFilesHash
ED458A089E908C078A33E92BA07BA4BDB1CD3716079EC0CFEB41F2283A80EA16
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
SessionHash
551BEF67330C80C564C8B1796117FE15AAB5F0CFE7CA1818A10D9639437ABD92
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0011
RegFilesHash
17AE0D8199E3E249EDD9191CBCB1AD9B24F07B952C40263BAB4AFE57C308A0A2
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
SessionHash
6193D2C39E45601796CC2213449619C1CAF5F4AD3943BCB407143FBF5C7FA249
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0015
RegFilesHash
01DDAA92BB3F6AEB975105D072CE0EC47CFAC9C99763DAE574D60637EF29B3A1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
SessionHash
FC0CB2391042E75E33C6BCEEDB3FB41D38EF200F2A847AC5DF2FB6FEA72C1322
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFiles0000
C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\SVE\CPDF_Full.aapp
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0020
RegFilesHash
4E61BC734FDF7A2B1B1A68038C37872F8032F8F1CD5EFE71F44AD6F7B934BBA5
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
SessionHash
73FA482CE4100B46E4889B1A60AF06FA1949EDB8DC54CF2B43107A94B244169E
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0025
RegFilesHash
7114D998D7E99E171C1B5577D00ED30F49437C14DA416F84C9C02207490309E5
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
SessionHash
81C69972F935633B3DE1840B54B47E95FD08C30546CA4C3BFABACA1076925738
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195254.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0031
RegFilesHash
984B9BDCF2AA0DBE572B0A675289E5CA573BE5BAAA9C5D8BC4BBD4B2D0398B93
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
SessionHash
405C664ACB28D445EE87BE51D3E3441E09B2AA6E41ABAF3BA43F917B7E40EA49
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198494.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0036
RegFilesHash
93433987E3DB8A96D6A4347E01F0301DF1B602F15E2F9E92B221B748A90AAFBC
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Owner
88060000F47C54A3FFF2D401
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
SessionHash
732C0A14A00C9F2C7E3CE2AC9674A01F3321F6888FFD85F0C7AAF2D1CA5CA51B
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
Sequence
1
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF
1672
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0041
RegFilesHash
C6D82C8E35B38E702AFCCE84D84815D7BDEA3FEF494916B6AA1DD2CEFF2F73EC
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
SessionHash
2C4C4D8885996691689A46F3FFD59A9BB76E68309B3E9872EA4CC3C698EBC79F
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0002
RegFilesHash
91D784321F713BBDB3E050E5BA529B2118A43124BEE6B766B63AB9328F5AB1EF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
SessionHash
7668DED1AD777C1DA962757A03DDC787D9E362D32A5FC6E33E510837166B3638
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0006
RegFilesHash
9227A85A4106822ECC044EF3D8C500D927456F210CF3C78700F870F7584C9087
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
SessionHash
0B730D4DF8740685C9395B6ABF868F1F1516248F75F9EB2559D161070F4BAA93
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0010
RegFilesHash
185DEF8F31734F8B265FD8D5A1345A9218083D157B49471AE89986BB2C10CB1A
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
SessionHash
A24F2E97F444ADC245198D5218E631BABE91FF468BBD02C5689ADDD95F32C440
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFiles0000
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0014
RegFilesHash
9B8B8335B9F5D78ED806DB159163CC5571C968EC900E883396322FA678D67F85
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
SessionHash
615F25D840093C87BE2D055BE2B45166361B01ED793FBC09B9E98B22CE8DE7EE
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFiles0000
C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\FRA\EPDF_RHP.aapp
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0019
RegFilesHash
9308E6F53D2CB24BB23A459EA6711C1881026D936AE88B3C4DAABADB542DA7AE
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
SessionHash
85D5FE8B2AE616BBD48E1A2782AA639C1DD4088FEED05FA9A30948FDDBAF29E4
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152876.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0024
RegFilesHash
F1D1CC1CFB846125653094D9BA965EA2B35A20A8EA9A91187BCECA4EADB14E49
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
SessionHash
50F3F128A019B87451C361AB3159124ABF245E9CAD587F9760BC67C3FC9C82A7
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188519.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0029
RegFilesHash
2B85F40CB29E6CBFC34A0F1DAA4A5A24047E0029A1627AE818829C0DD95CEF0B
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
SessionHash
09ECE4BF37D2649A8DD516B91D084B6494D48572BEDF3CE8CC6780F9356AED8C
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196364.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0034
RegFilesHash
1D4E1037B259821AEB9E5D364903C1598F6E13D91E65715B6F79C672BBC2687E
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
SessionHash
ED341D60998E437DF22A4DEE10E7AA2F5416B3C36323C5F2EAB7B3E20F1E26CB
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200611.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0039
RegFilesHash
70A90ADDDCA87AB8E0E5EB0AF4320D9BE282B6C98C6680EB81557405F308F2A5
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
SessionHash
3502D657B87690434B0A1EE9B2D59F00EC6C4E4F6A6E18DA49731714CC5055FD
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0230553.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0044
RegFilesHash
BBB2A373DF5296233F03031E05B1183F6680B7A1E996B0E721EEA40E39DECA66
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Owner
5409000078546CA3FFF2D401
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
SessionHash
3CF109A7D75E57581C951844734AB987DF9D75F692595BC26B8C3B476F942A10
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
Sequence
1
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFiles0000
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF
2388
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0003
RegFilesHash
8CFD1DC0ACDF8FD0F292EE4AEDEEA0C132F9FCA28D5862B418F6312E5FDC7751
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Owner
38010000E0DD75A3FFF2D401
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
SessionHash
2073AB4E1AA8D6499AAED292CCB199C3EB367CF894E8DB288E54AFE549CB875A
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
Sequence
1
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFiles0000
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0004
RegFilesHash
B830AEEF2C77F73334518BEB73D73EE8009D8DF7544D1FDB7ACA6063B01C3845
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
Owner
38010000E0DD75A3FFF2D401
312
tgytutrc5079.exe
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0008
SessionHash
83A4E63C77047200D4DAEF74BA877E5C144A6A6D99F3B7DA48217B353356AB2F
312
tgytutrc5079.exe
<