Malware Analysis Report

2024-08-06 12:48

Sample ID 240602-kzyz2shd58
Target 253MzWzDFZpiHVY2S4PKfM-1200-80.jpg
SHA256 d53b61c198eca2409f7f8f731e8d0e1a09e084a9a4a889c617c7ea7718d153b8
Tags
stealerium collection stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d53b61c198eca2409f7f8f731e8d0e1a09e084a9a4a889c617c7ea7718d153b8

Threat Level: Known bad

The file 253MzWzDFZpiHVY2S4PKfM-1200-80.jpg was found to be: Known bad.

Malicious Activity Summary

stealerium collection stealer

Stealerium

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

outlook_win_path

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

outlook_office_path

Enumerates system info in registry

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Email Collection
T1114
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-02 09:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 09:02

Reported

2024-06-02 09:23

Platform

win11-20240426-en

Max time kernel

1199s

Max time network

1178s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\253MzWzDFZpiHVY2S4PKfM-1200-80.jpg

Signatures

Stealerium

stealer stealerium

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617926231189159" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Vision Setup.zip:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A
N/A N/A C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1304 wrote to memory of 3552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3552 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 1576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1304 wrote to memory of 3704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\253MzWzDFZpiHVY2S4PKfM-1200-80.jpg

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1c49ab58,0x7ffb1c49ab68,0x7ffb1c49ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4264 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4244 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4900 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4724 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3292 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3432 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3396 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3772 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4368 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe

"C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe"

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 --field-trial-handle=1772,i,10735480930753095861,11725926644582132173,131072 /prefetch:2

C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe

"C:\Users\Admin\Downloads\Vision Setup\Vision Builder.exe"

Network

Country Destination Domain Proto
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.187.238:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 172.67.69.88:443 shorturl.at tcp
US 172.67.69.88:443 shorturl.at tcp
DE 88.198.63.72:443 anonymfile.com tcp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 104.17.248.203:443 unpkg.com tcp
US 104.17.248.203:443 unpkg.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com udp
NL 139.45.197.245:443 waisheph.com tcp
NL 139.45.197.245:443 waisheph.com tcp
NL 139.45.195.8:443 my.rtmark.net tcp
NL 139.45.197.236:443 yonmewon.com tcp
NL 212.117.190.201:443 sr7pv7n5x.com tcp
US 104.21.11.245:443 tzegilo.com tcp
GB 142.250.187.202:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 245.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 8.195.45.139.in-addr.arpa udp
US 8.8.8.8:53 236.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 201.190.117.212.in-addr.arpa udp
NL 139.45.195.254:443 flerap.com tcp
NL 139.45.195.254:443 flerap.com tcp
NL 139.45.195.253:443 datatechonert.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
GB 142.250.187.196:443 www.google.com udp
NL 52.111.243.31:443 tcp
NL 139.45.197.245:443 waisheph.com tcp
NL 139.45.195.8:443 my.rtmark.net tcp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.180.14:443 encrypted-tbn2.gstatic.com tcp
GB 142.250.178.3:443 id.google.com tcp
GB 142.250.180.14:443 encrypted-tbn2.gstatic.com udp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn1.gstatic.com tcp
GB 142.250.179.238:443 play.google.com udp
GB 216.58.212.241:443 csp.withgoogle.com tcp
GB 216.58.212.241:443 csp.withgoogle.com udp
US 162.159.135.232:443 discord.com tcp
US 104.16.184.241:80 icanhazip.com tcp
US 152.199.19.74:80 evcs-ocsp.ws.symantec.com tcp
US 104.16.184.241:80 icanhazip.com tcp
FR 151.80.29.83:443 api.gofile.io tcp
US 136.175.10.233:443 store3.gofile.io tcp
US 104.16.184.241:80 icanhazip.com tcp
US 162.159.135.232:443 discord.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
FR 34.155.84.81:443 e2c25.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gvt2.com tcp
US 192.178.49.195:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 195.49.178.192.in-addr.arpa udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 216.239.34.117:443 beacons2.gvt2.com tcp
US 216.239.34.117:443 beacons2.gvt2.com udp

Files

\??\pipe\crashpad_1304_YDUUPADIMACHXQMU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ff383438ed2f92fd6092410599981222
SHA1 6b28213d1af713c664ca182a94aef6f58e5e4030
SHA256 503e80b367fe628ff5c168188dbe09f908ef8f34dfac21ddb0b09fed678dc454
SHA512 fc23334f968af141bda224f68db1ce96b4272f5532345c9ec53621b35adb0eaae7b7726549a7d9b1269a4ffb784e3b5be29886d96a20f83f40150cf0167ec019

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 aa5961b64c1d787d4b4ab5b9aa5d3eb1
SHA1 f46b2c24eb1dce8ae856cfa0c091c562019310b6
SHA256 5b03d185ca7a829018effdd33e40157ae60837086315961c9ff09ca753fd8106
SHA512 0e787abe4fae1f34339723e0deee89fa913f0ab85209aed1cd9bcf39ec701fa834ece5f240e22438dc87dff5a742e2e52cf55c45fe73b60f3c9b2cb12013bc0a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 8c089e0f8a7a9945fc93f6bd3a53901a
SHA1 020f035bdb1e7184036870923ee687557a05f84a
SHA256 90eecaf87712f754e149d85d876606ab3806d376107cd8dbd4da91fc1ebb1479
SHA512 53b1182470210de41a59659a207810313f59fd7fe6fbdb2329b0d21e76798d99fa79fcacbfbd9673b8399a12a8b7f907c7b9eebac8c61fffc47e7f3d8b0ae5e6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 fc95d297c5f9e8535a0a00cd8c5a8591
SHA1 b96b9a72d783400fc14bca02f8d1c9392c03bd90
SHA256 539017932de5dbb13acbff145a41506f907c62f915cd9f95755c443eff32ab38
SHA512 e4b329f354176437a7b6cb12c354ba189627bcd4840a1f038f4e25ab1bc40e84c1dcaba00f9268b53fa723a201d784075796e3176f5db5c01cbb4cdb31645f36

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 5597df4f05bbf4e7ae06afb3e33f5e82
SHA1 870618b2b95cb80a18730dfca802f21835199767
SHA256 a9e6c83b92321e07a8023f38b28e8a30f25ea61441082e809110fbe9458cb3b8
SHA512 56cdd312ba9941a41d8a3a6685c724ec6d6f1684cfe09d3a0d48e3806887299c5eb13a6c479b9b6484bffd0c70d407161f91a25b4bf448b86e82d044b680d7c9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c0767d7d28536c1bac07c5838070adb2
SHA1 5c15c119a48483ca4c6abb5c4723ecf9c689a4c9
SHA256 5f99cea07f702319d4605c1983b8c87f1fbb2466a59afc1140011edbb8c82e5f
SHA512 121f97441f4ae9656d0ec04c7af881248959edfec0db2dfbc83b33d401e46b65eafaa18efdce9d2086adff6f845d5b282419681161f17e57752e4779da9b8573

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57eb3b.TMP

MD5 7dc678b2e4d9f4777ba7266571ebd48b
SHA1 862e8ea3ad517f38a7f882ee3f19361708b0631c
SHA256 432399804196e4dd92de748258682a0b4f17d98a1b46a5d3befadbf4e2bce430
SHA512 4d1405a8a7cd12b5589397c991115ff98d8d76fa4c3a3cff648c0d2c22a82b0bac2f007dd8015c7f39b30342540494e70551aa90779f5a00b666977b66aa2b6d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 c40c6cba0110a8379e3a0011338cac5c
SHA1 a1d6838d2075e5d3a18a894653d0eb7f5a1bcdd9
SHA256 29482be89b9dccd8f786e9a2884d855479b23e0d36b79f91d150d8868ca27fc4
SHA512 7806732d9177ac695f79222f164ef0a320f34d16b2991c5c3c5b1cb7cfccdc90df2cacb5986af693838eb7b10cd148f4ae0111e647daf4938db6d8b3d3819c40

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6e9db9bbad24612f615c1040a210ef2b
SHA1 c9f627524973afcd00ff2b1f45370885eda3eb9b
SHA256 15a79a67e1a83649eb133a738c0de06daad6cecf0ec6a5972a0054e609b6b78c
SHA512 f989379ff9f332397cecb979808ca958ead0f4a6e0196b708cb3f844d4efb357312258a7894ce635e32565a1e5caafdfa1d926a1724dd5efa7910898f4bce817

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 3b7b08ad6d834d7ba6f6204f1a79269e
SHA1 0a6e7d47ae46d05db5e0de01d01889ba76428137
SHA256 7cd43df328a45dc8df1adb5b8120c2f82b22479e7cad76fbe4ab7c73871e341a
SHA512 5dcbb8b9ae9e2240de7eae808299ec4c2972298d73b406ff612de2de1e6fd71fee9b6b6b4c8869316a993ebf5339ace33f11777ab61be93ba229f264fdc12186

C:\Users\Admin\Downloads\Vision Setup.zip:Zone.Identifier

MD5 d1dd9841560917da3c248a9b9eb12547
SHA1 ef9248263add8f18682686722bb815fee9a2a22b
SHA256 5a493d8749e405bfae2823698da13c068558742dda25731ba6f6446616eb31bc
SHA512 7f475c1e3b4ab7b685945722476c3d474e0c8f08f7bc4ca14d027f244e9b8faca490c2ca210b6f32682d7d46b89b4e2851de0f02c3b804d0e4a656798eea233e

C:\Users\Admin\Downloads\Vision Setup.zip

MD5 9099e2fd286020ab5e0c58d37af9e949
SHA1 8030ccbc0d41bd220178e81d6c622bc035a08f6b
SHA256 63d7969adc66a9a904c6d7a0e5f8338daecaa1781ce6094fbea7a5768a0b6d9b
SHA512 9040beb22fcc0773b78b680cd3490108caecb9d5bad0718d446e9b72840d8ade52db71a21bf3202ec46d76874d42ebc7433fc93ffb749ba90a283f0e1310b828

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fca9db9759862eaac108518b8e796b53
SHA1 f34673886d38b03574c4134c8e2575375c837901
SHA256 240d0fa622071076399eee51f5f6fcad44d7df919829cb53f7a713238b8b748e
SHA512 f17265c4b4a47d13ef98a2a9c73b3e6d4d6b61e5227762dc50b9b06d8f3011a98a7c5568b539910ec663d5b28d1bdf4b5d0ee9b3fb0c3b0e1564c520d33c62e4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 3f7b2e2cd8e6ff6de02720ca4ce09596
SHA1 2a6a7676127929123f32b870b3c67c1563251e96
SHA256 3fbb991c85e71e700c2701cd764ab561614886bb5b360eabae9d099d93ea9bbc
SHA512 c4405db851843d33d47f7d1199f744d7eafa6e9ca619705ade3d4679550c1b8d8884ee52a5466fa33dc20d64b7be5d2e898b711d2232b43e42490846551ad11b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 8ceaaf3ca9cc31e8348d07b33a7aa075
SHA1 46136436840ce9027822b6658c90bdc54d8db94e
SHA256 0a419220f099d798ad79fcafb69c6c50d50d9fe701bcc9fad34a0b007638d8e3
SHA512 d4b9285abff8324ff31db06ebda2db7def9e7600d12ef5ab72d0bfa50ec20d4429243dd676a42a1dd5adfa5608c6181857f23568758797b12cd3739c35c50faf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 df1e0b591ea9774b9624b40fcd235c7f
SHA1 8bd71f92a94fb0e7fb6ab2ecca20199f92060528
SHA256 8d36a5247ff91346621d70cf50449aab21e726530c0507d6d7d379f3c0d69947
SHA512 62b964bf2adce59b5556b9303ba8dccfd1d82b8c6e7e6ce9ce83c546ecb3c5763cd9634c9d493a38c6e15ead1c9f7dc8eeb86601c31ffbfb0d207a525c52ac32

memory/572-281-0x000000007449E000-0x000000007449F000-memory.dmp

memory/572-282-0x00000000006C0000-0x0000000000852000-memory.dmp

memory/572-283-0x0000000005300000-0x0000000005366000-memory.dmp

memory/572-284-0x0000000074490000-0x0000000074C41000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a86ff9f676bf5100f46afdced113a350
SHA1 6873359f24371726468a6f236416f0a27457aed5
SHA256 10460220f2ac49bb14b85263809ced31925d6c51443dab7741b4d7a092df202b
SHA512 b4a1082a32ff1fde7116fb40fb9c8a3214c3d167e24fe2c104409290aeea0bc57445e6d633b9d610b164bc1075d732457f9298e12caa8c4c5ef278750fc7bd99

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 2f23663111658be2ba0b273463ff5e60
SHA1 c2af77369b83a0177bfdb90c11fad4c5f897a983
SHA256 eab4709a1ad32b0b87a53d307893899eb3ee26c6a59a1b34fe83062c79817513
SHA512 e0fdfe555a47709cbf14c4c22498c89c3e8fd61c5b40806b9dd06aee20fbdcd3d9c4f7861d1183df15e9c64ed25828f97c8292bc6b4a700d3d4586433bf45bd8

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 0e3aeafd55d6bd5185cac0576dc68cde
SHA1 138e081aba01626f9cbcf67c0a886a035cd1329f
SHA256 9227c44bbf30ab193b600d87eb927114d968ab9334f4b0bcbf185464576fd9fc
SHA512 23d308c78e35cb3c53f9d417f9e741c8cdda41cd9d32fb72547a3b5f2983831e9ac5e601f7f261386dde110cfe93e7a2a31e6d060a4454a233eb7fcd33dbcaad

memory/572-316-0x0000000005950000-0x00000000059E2000-memory.dmp

memory/572-317-0x00000000059E0000-0x0000000005A06000-memory.dmp

memory/572-318-0x0000000005A10000-0x0000000005A18000-memory.dmp

memory/572-319-0x0000000006830000-0x000000000683A000-memory.dmp

memory/572-320-0x0000000006840000-0x0000000006848000-memory.dmp

memory/572-321-0x0000000006860000-0x000000000687E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

MD5 04cd08c216fd23f6d60cd09838533368
SHA1 b1112e22d1f849f4bebd03aea25bf509b3e544d6
SHA256 713d774fb07eee83a2b7ebf5d33bf72b53c939c38151c521d7feedec7a884bba
SHA512 da5fe1751ffa2b281be3459aa27703512e694975ce4aa2122c2f81d7002fc808ee270c201f340e9166df3e288f3378366f5cc0d1e303f4be76d8e9887a08d0e9

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\Browsers\Google\History.txt

MD5 e55e6fe079d799098739738b89ba3bc4
SHA1 8c2dc6b0a4b004defc95bd35efedf8ed6de767a3
SHA256 e51b1dcce8d17244001878b99eb7c156f44a89589dd16494fb95201f33921625
SHA512 6c2ee7e874271ff8139bc991f42bfa8e3becd5d40f484590da6401c0be9e51d08a0143a0b3e74c6556bf277b999778aa94c61aae895a3e1684578e7a389c3d80

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

MD5 599a3a3f99eac7b6fa46e49ddb2e4798
SHA1 f4dfb2e3989d0861d5e084fd5c9845a14ea57ebf
SHA256 a31dae87e4e48f8a7fab75e1980d721b21b5401dbf269181096bb97e1748b649
SHA512 062656fe3a98bed7d59b75c984a6f5f8f6c74364868e32a6c67773db7541466dfe4bec95649239175d3b5478928683808bd63abd11906804012e502ed1845ed5

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

memory/572-390-0x0000000006E20000-0x0000000006EB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log

MD5 d634b7a5fd6e30a4c4539198cc4d4d49
SHA1 9936106378516dc3d7cfe03d774f35f7a874eee2
SHA256 1fc316337cdf996e019b3ffdca04d0ee907a0647beda989f9f6cd60f2e9377b7
SHA512 7b0d4e50053227b1d9975d71beb8c0f4522594fb739f43d27e39c7968016a089f29c5727bf06cd791ccb0bf2e2f42ab32a5768ae2bea8e177b544e1ab034f328

memory/572-395-0x00000000075B0000-0x0000000007B56000-memory.dmp

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\System\Process.txt

MD5 dd7b4ae1b3fc317bc5f12d78e5b32f00
SHA1 e554937411f84e64a77003ffcb8b25cd3f782370
SHA256 3af1ef553c4ede6ebf4f79dcc09752c2a7ab081f47fa4d2f67809cd4815fa413
SHA512 e735ad810382d5fa53d9a158d93b096edbddf353b6ce061c62184c2bef7c1a631e4df3ac59a78d8d1044d14434e0eba3421c97738271665394ca62ed647538a2

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\System\Apps.txt

MD5 f5b7879a4090071290baaea32286f32f
SHA1 d912a731d51980145a29f51c22eb2942969adda3
SHA256 aa60030804399c5561977f157626c51ddb1f69a7e5f308d1981f898a822e0334
SHA512 9ff82276ea8f83c67dc9119c4ffa131adc1ada0bc9e93eee6e6096d48d243105ab3bf590314872dab729166c31abd572b1ed6bfc9c85a97ef016a97a09e1e7e3

memory/572-526-0x00000000069D0000-0x0000000006A4A000-memory.dmp

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\Browsers\Google\Downloads.txt

MD5 55af2cd7cb1894cba70fe4f823e1781e
SHA1 e9d46db3a278309fdda65f5455cd5f66acc34775
SHA256 fb26c911089be405b32563902a5e50f48e5c67cf968a25dd1a32911aa58ad6b8
SHA512 023ea54644a0b18968063bbd0000b0b716953da071db567be7aefbe01afcc746c23d05eb2aac6fef595bc532b1655d5244397cb3b78aae2f7eb55a4d45249643

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\Directories\OneDrive.txt

MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\Directories\Videos.txt

MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\Directories\Startup.txt

MD5 68c93da4981d591704cea7b71cebfb97
SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\Admin@ERYHRVLX_en-US\System\ProductKey.txt

MD5 71eb5479298c7afc6d126fa04d2a9bde
SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

memory/572-608-0x0000000006AF0000-0x0000000006BA2000-memory.dmp

memory/572-610-0x0000000006BA0000-0x0000000006BC2000-memory.dmp

memory/572-611-0x0000000007F60000-0x00000000082B7000-memory.dmp

memory/572-613-0x000000007449E000-0x000000007449F000-memory.dmp

memory/572-614-0x0000000074490000-0x0000000074C41000-memory.dmp

C:\Users\Admin\AppData\Local\e4113ee5821bbc7763e4c773544cdeda\msgid.dat

MD5 5d79717fd2ecc37623e53392fd1b5903
SHA1 dd95ba2dcb702f459a9220dfec85d7a0134eacca
SHA256 c206bd570dbd8527504f24da4eb790805794985d88cfdc1b73f34439b29762ee
SHA512 b24a994f95b8647758e142eea62bb38b6840a0f87786bd2cd1fdaeeb02c9cf063527fb3db3587a33a5d0e88adefc13d4ad3f2af6ef088df5d69e2ab726d514ed

memory/572-625-0x0000000007310000-0x000000000731A000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 36cbb17278fe07c336e6247d38257138
SHA1 db2ec339832c11b4795cbf194822c778ecba6860
SHA256 10d07d1edc9d8df1b9190d404f030b58fa624daa4aef49c58067c5d210b18cfd
SHA512 88305126b656269eda5c9a20aa762370bed2a146a4f403061966722434206a18d35174e983f6c638ac3db241d2a6bc34f8aef5cd7ed1da56206454078c610ad2