Malware Analysis Report

2024-08-06 12:43

Sample ID 240616-vjqnvathnq
Target build.exe
SHA256 c3cb7705b9a58c4a53e9db5a935972b6666f4848a117e0de4e938b70443fcd8e
Tags
stealerium collection discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c3cb7705b9a58c4a53e9db5a935972b6666f4848a117e0de4e938b70443fcd8e

Threat Level: Known bad

The file build.exe was found to be: Known bad.

Malicious Activity Summary

stealerium collection discovery persistence spyware stealer

Stealerium family

Stealerium

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Adds Run key to start application

Enumerates connected drives

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Accesses Microsoft Outlook profiles

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Modifies data under HKEY_USERS

outlook_win_path

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

outlook_office_path

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Email Collection
T1114
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 17:01

Signatures

Stealerium family

stealerium

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 17:01

Reported

2024-06-16 17:06

Platform

win10-20240611-en

Max time kernel

298s

Max time network

305s

Command Line

"C:\Users\Admin\AppData\Local\Temp\build.exe"

Signatures

Stealerium

stealer stealerium

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Everything\Everything.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\Everything.exe N/A
N/A N/A C:\Program Files (x86)\Everything\Everything.exe N/A
N/A N/A C:\Program Files (x86)\Everything\Everything.exe N/A
N/A N/A C:\Program Files (x86)\Everything\Everything.exe N/A
N/A N/A C:\Program Files (x86)\Everything\Everything.exe N/A
N/A N/A C:\Users\Admin\Downloads\dotnet-sdk-6.0.423-win-x64.exe N/A
N/A N/A C:\Windows\Temp\{9B05CC39-0D58-40B0-89A9-7C5BEF380988}\.cr\dotnet-sdk-6.0.423-win-x64.exe N/A
N/A N/A C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Windows\Temp\{9B05CC39-0D58-40B0-89A9-7C5BEF380988}\.cr\dotnet-sdk-6.0.423-win-x64.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Everything = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" -startup" C:\Program Files (x86)\Everything\Everything.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ff484a27-57a9-4e6a-b58c-136510aba400} = "\"C:\\ProgramData\\Package Cache\\{ff484a27-57a9-4e6a-b58c-136510aba400}\\dotnet-sdk-6.0.423-win-x64.exe\" /burn.runonce" C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\J: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\X: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\Y: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\M: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\P: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\S: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\T: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\Z: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\H: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\K: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\N: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\O: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\U: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\G: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\V: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\W: C:\Program Files (x86)\Everything\Everything.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\api-ms-win-core-timezone-l1-1-0.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Runtime.InteropServices.RuntimeInformation.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Diagnostics.DiagnosticSource.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\ru\UIAutomationTypes.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.AspNetCore.Components.Forms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\sdk-manifests\6.0.300\microsoft.net.workload.mono.toolchain\localize\WorkloadManifest.fr.json C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.IO.Pipes.AccessControl.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Net.Http.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Diagnostics.Process.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Net.WebHeaderCollection.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Net.WebSockets.Client.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.31\ref\net6.0\System.Security.Cryptography.Pkcs.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.Extensions.Configuration.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\api-ms-win-core-errorhandling-l1-1-0.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Runtime.Serialization.Xml.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.IO.FileSystem.AccessControl.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.AspNetCore.Server.Kestrel.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.Extensions.Configuration.Binder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\Microsoft.Win32.Primitives.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\netstandard.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.IO.FileSystem.Watcher.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Data.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.31\ref\net6.0\System.Security.Cryptography.Xml.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.Web.HttpUtility.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.Net.Security.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Host.win-x64\6.0.31\runtimes\win-x64\native\singlefilehost.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\D3DCompiler_47_cor3.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\System.Diagnostics.EventLog.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\sdk\6.0.423\runtimes\win\lib\net6.0\System.Drawing.Common.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.Reflection.Metadata.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.Resources.ResourceManager.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\api-ms-win-core-util-l1-1-0.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.Diagnostics.Tracing.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.AspNetCore.Hosting.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.AspNetCore.SignalR.Core.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\api-ms-win-core-namedpipe-l1-1-0.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.IO.Compression.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Console.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\System.Windows.Forms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\ko\PresentationUI.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\cs\PresentationFramework.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.AspNetCore.StaticFiles.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\sdk-manifests\6.0.300\microsoft.net.sdk.android\WorkloadManifest.json C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.IO.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.ComponentModel.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\es\PresentationCore.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\ja\System.Windows.Forms.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\pl\System.Xaml.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\ja\System.Windows.Forms.Primitives.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.AspNetCore.Mvc.Razor.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.31\ref\net6.0\System.Threading.Thread.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Xml.XPath.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\ja\System.Windows.Controls.Ribbon.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\zh-Hant\WindowsBase.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.31\ref\net6.0\System.Printing.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.31\ref\net6.0\Microsoft.AspNetCore.Mvc.DataAnnotations.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Core.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.31\zh-Hans\UIAutomationTypes.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.31\ref\net6.0\System.DirectoryServices.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.31\ref\net6.0\Microsoft.VisualBasic.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.31\analyzers\dotnet\cs\tr\System.Windows.Forms.Analyzers.CSharp.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\mscorrc.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.31\System.Xml.XDocument.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI1CB6.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0f7.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac11b.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI1426.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2527.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4E3E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI82C1.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI22C4.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac0e4.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI385F.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac101.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC66F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac0cb.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{78B8BA23-B5FD-4F1F-9060-4ABB46DA6843} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0f2.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0fd.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI806C.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE6BD.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI34F3.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac125.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB7D4.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{59ED1DC1-E3E4-4BC0-B43F-143CCC38FF17} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0de.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac0f8.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{BBA9C60D-75E7-44EE-922D-069AA85C8EC1} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI7A79.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac0fd.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac106.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFF9F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE87.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI27C8.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac0e9.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI56FC.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC257.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI73B9.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI799D.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac11a.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0e8.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI58C2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEB16.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0d5.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6BA2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac107.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac111.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0ee.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{3D938008-01C4-3077-8FD7-CE0736059E08} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI7F71.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{DBB48387-294D-4179-81CB-B06A97F8CD8E} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac124.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE8C1.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF56C.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{62BB74E2-94F6-430A-80FD-ECF223D0CEDC} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0fc.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI74D3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac0df.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac0ee.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6D0B.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5ac12a.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{91435084-93F5-4F91-9E5E-1DAE72D2E3B7} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{81ED78D2-5E73-4D2B-BBC4-16F10FAE87EB} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0e9.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5ac0ed.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{EFE53353-800E-4987-B965-1C968D0F23A4} C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\build.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\build.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\build.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133630309725025180" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.124.15242_x64 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F4D47AFB2F354242A908871257917AE\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F4D47AFB2F354242A908871257917AE\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\800839D34C107703F87DEC706350E980\Version = "100663327" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\90B18CAF3E0999038A7CC99BB7879CE6\78384BBDD492971418BC0BA6798FDCE8 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.efu\ = "Everything.FileList" C:\Program Files (x86)\Everything\Everything.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D70F05904C1F5A74CA885CAF5ACD65D4\Version = "813448030" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E40D2999E3552CB40BCEA493D41D9968\Version = "813448030" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_apphost_pack_48.124.15198_x64_arm\Dependents\{ff484a27-57a9-4e6a-b58c-136510aba400} C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\NetCore_Templates_6.0_24.15.51890_x64\ = "{78B8BA23-B5FD-4F1F-9060-4ABB46DA6843}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\958F095FA6F29554D9908ACF44A21FB6\ProductName = "Microsoft.NET.Sdk.macOS.Manifest-6.0.300" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1523682C7E700A442B8FC4E4A20F9873\SourceList\PackageName = "Microsoft.NET.Sdk.Maui.Manifest-6.0.300.6.0.312-x64.msi" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8CE67BEF4F206E640813EB0473661DA3\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell C:\Program Files (x86)\Everything\Everything.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E47BB266F49A03408DFCE2F320DECCD\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\35335EFEE00878949B56C169D8F0324A\PackageCode = "EF99427020610A640B93DA8EB236BB86" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F4D47AFB2F354242A908871257917AE\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{FA74D4F0-3F2B-4245-A209-8817529771EA}v48.124.15242\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\32AB8B87DF5BF1F40906A4BB64AD8634\PackageCode = "A2CE46E774F5F5E42B2619AC45225F73" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\NetCore_Templates_6.0_24.15.51890_x64\Dependents\{ff484a27-57a9-4e6a-b58c-136510aba400} C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C195E4FD01863D44B9FCD550103911D\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E40D2999E3552CB40BCEA493D41D9968\MainFeature C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\800839D34C107703F87DEC706350E980\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\32AB8B87DF5BF1F40906A4BB64AD8634\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8CE67BEF4F206E640813EB0473661DA3\F_PackageContent C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D70F05904C1F5A74CA885CAF5ACD65D4\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D70F05904C1F5A74CA885CAF5ACD65D4\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.124.15198_x64\Dependents\{ff484a27-57a9-4e6a-b58c-136510aba400} C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\800839D34C107703F87DEC706350E980\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F05E070573A881832BFDA34C6488221A C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.NET.Sdk.tvOS,6.0.300,x64 C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.124.15198_x64\Version = "48.124.15198" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D70F05904C1F5A74CA885CAF5ACD65D4\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D87DE1837E5B2D4BB4C611FF0EA78BE C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFC6307A304B895458FF3D79BA8B1837\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\35335EFEE00878949B56C169D8F0324A\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2FBEA284FA85CDC7D3BCDEF399E3639B C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.NET.Sdk.MacCatalyst,6.0.300,x64 C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78384BBDD492971418BC0BA6798FDCE8\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.124.15198_x64 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.124.15198_x64 C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1CD1DE954E3E0CB44BF341C3CC83FF71\MainFeature C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480534195F3919F4E9E5D1EA272D3E7B\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D06C9ABB7E57EE4429D260A98AC5E81C\F_DependencyProvider C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D70F05904C1F5A74CA885CAF5ACD65D4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0950F07D-F1C4-47A5-AC88-C5FAA5DC564D}v48.124.15198\\" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E47BB266F49A03408DFCE2F320DECCD\Version = "813448030" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5355BA327776339458D57447611F4AF0\PackageCode = "E856DDBA4D3E89B4387175B428D84B72" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFC6307A304B895458FF3D79BA8B1837 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0F4D47AFB2F354242A908871257917AE C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.AspNetCore.TargetingPack_x64_en_US.UTF-8,v6.0.31-servicing.24269.8\Dependents\{ff484a27-57a9-4e6a-b58c-136510aba400} C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C195E4FD01863D44B9FCD550103911D\Version = "2152415232" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78384BBDD492971418BC0BA6798FDCE8\PackageCode = "9855201C73BBFD04DBE4B2575DFB6359" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Program Files (x86)\Everything\Everything.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.124.15198_x64\DisplayName = "Microsoft .NET Runtime - 6.0.31 (x64)" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D70F05904C1F5A74CA885CAF5ACD65D4\MainFeature C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_apphost_pack_48.124.15198_x64_x86\Version = "48.124.15198" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F64EA8DCAC8FF74D92B8B828931187C\Version = "813448030" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_targeting_pack_48.124.15242_x64 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\32AB8B87DF5BF1F40906A4BB64AD8634 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.NET.Workload.Emscripten,6.0.300,x64\ = "{9D112618-DBF3-4FB6-AAB4-22F705D929F2}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\816211D93FBD6BF4AA4B227F509D922F\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.NET.Workload.Emscripten,6.0.300,x64 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 C:\Program Files (x86)\Everything\Everything.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480534195F3919F4E9E5D1EA272D3E7B\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.AspNetCore.TargetingPack_x64_en_US.UTF-8,v6.0.31-servicing.24269.8\DisplayName = "Microsoft ASP.NET Core 6.0.31 Targeting Pack (x64)" C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\build.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Everything\Everything.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Everything\Everything.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4852 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\build.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\build.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\build.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2120 wrote to memory of 2952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2120 wrote to memory of 2952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2120 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2120 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2120 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2120 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2120 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2120 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4852 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\build.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\build.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\build.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4476 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4476 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4476 wrote to memory of 4040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4476 wrote to memory of 4040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4476 wrote to memory of 4040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 4920 wrote to memory of 384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 5008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 2580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 2580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4920 wrote to memory of 3436 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\build.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\build.exe

"C:\Users\Admin\AppData\Local\Temp\build.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 3184

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdef2a9758,0x7ffdef2a9768,0x7ffdef2a9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2028 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2708 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3840 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff6ab2a7688,0x7ff6ab2a7698,0x7ff6ab2a76a8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5164 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3180 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5676 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5644 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5908 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5488 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5932 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6160 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4912 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5784 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3176 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6196 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe

"C:\Users\Admin\Downloads\Everything-1.4.1.1024.x86-Setup.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\Everything.exe

"C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\Everything.exe" -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"

C:\Program Files (x86)\Everything\Everything.exe

"C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0

C:\Program Files (x86)\Everything\Everything.exe

"C:\Program Files (x86)\Everything\Everything.exe" -svc

C:\Program Files (x86)\Everything\Everything.exe

"C:\Program Files (x86)\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033

C:\Program Files (x86)\Everything\Everything.exe

"C:\Program Files (x86)\Everything\Everything.exe"

C:\Users\Admin\AppData\Local\Temp\build.exe

"C:\Users\Admin\AppData\Local\Temp\build.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 2672

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3828 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1572 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1548 --field-trial-handle=1628,i,10854166592278758720,7457830273834410867,131072 /prefetch:8

C:\Users\Admin\Downloads\dotnet-sdk-6.0.423-win-x64.exe

"C:\Users\Admin\Downloads\dotnet-sdk-6.0.423-win-x64.exe"

C:\Windows\Temp\{9B05CC39-0D58-40B0-89A9-7C5BEF380988}\.cr\dotnet-sdk-6.0.423-win-x64.exe

"C:\Windows\Temp\{9B05CC39-0D58-40B0-89A9-7C5BEF380988}\.cr\dotnet-sdk-6.0.423-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-sdk-6.0.423-win-x64.exe" -burn.filehandle.attached=604 -burn.filehandle.self=600

C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe

"C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe" -q -burn.elevated BurnPipe.{64419D4F-EEEA-43DD-86AC-19AD22B14584} {19B1D485-34F4-4E12-B37B-110AEB7DFC5E} 4648

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C37C38332EFEBFDACE3F6DE5D78BB20F

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding D43D40CF6C60013FAF1F8F0A91357343

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 765ADC165E654CAA3842D16E97A4D866

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 9C3622ACDDC49C7AC85117E532519D54

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 813FA7A8864391C59315FB7C8D06B5D3

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding E6F6631FA61435B64E9959227ECA3B20

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 8C06E4C4FB5937DF0CD01EA16530E4D5

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 3FD67B6DFED7208553AAEFBF3F4C8652

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 27D51EBA5F805D7BB9D585605A7CC8C7

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 17EA051841790BF71D3F649535C01FB1

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 4BCEBD54E3910EB435F6D15033B23C53

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 5CA24E57BC7B7F8829D23B6B64472687

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 37C68CB7AB09FE09B7DDC6FD1DADF9B2

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding E5E1548631A51FAFFD11F2F3F241085A

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 0FEFB2178C0C3D3B2942ADE7838784AB

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding D95087077A13244FDE9E7E3F4A50BE04

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 522D20E5470CD46EE163A978643A0D1E

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F98CF5AB01E69C6716844B7CD25A979C

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 56F5C908F20A88CF2C72360017D94C97

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 997D3C2EB538EE49BCE287E9770A4BF8

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 3334833DAEBE41BF955546C481E73713

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 5932EB50D767C8D8239BB80C729D7513

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Users\Admin\AppData\Local\Temp\build.exe

"C:\Users\Admin\AppData\Local\Temp\build.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 20.189.173.11:443 tcp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 241.184.16.104.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 66.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 evcs-ocsp.ws.symantec.com udp
US 152.199.19.74:80 evcs-ocsp.ws.symantec.com tcp
US 8.8.8.8:53 74.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
DE 142.250.185.68:443 www.google.com udp
DE 142.250.185.68:443 www.google.com tcp
US 8.8.8.8:53 195.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 68.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
DE 142.250.185.174:443 apis.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 174.185.250.142.in-addr.arpa udp
DE 142.250.186.110:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 110.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 227.181.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.74.250.142.in-addr.arpa udp
DE 142.250.186.110:443 play.google.com udp
US 8.8.8.8:53 consent.google.com udp
DE 142.250.185.142:443 consent.google.com tcp
US 8.8.8.8:53 142.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 dotnet.microsoft.com udp
US 13.107.246.64:443 dotnet.microsoft.com tcp
US 13.107.246.64:443 dotnet.microsoft.com tcp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 23.200.189.225:443 www.microsoft.com tcp
US 8.8.8.8:53 225.189.200.23.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 target.microsoft.com udp
US 8.8.8.8:53 49.43.201.23.in-addr.arpa udp
US 23.200.189.225:443 www.microsoft.com tcp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 52.182.143.208:443 browser.events.data.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 w.usabilla.com udp
IE 54.171.39.250:443 w.usabilla.com tcp
US 8.8.8.8:53 westus2-0.in.applicationinsights.azure.com udp
US 20.9.155.145:443 westus2-0.in.applicationinsights.azure.com tcp
US 8.8.8.8:53 d6tizftlrpuof.cloudfront.net udp
HU 18.239.253.68:443 d6tizftlrpuof.cloudfront.net tcp
US 52.182.143.208:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 250.39.171.54.in-addr.arpa udp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 77.255.239.18.in-addr.arpa udp
US 8.8.8.8:53 145.155.9.20.in-addr.arpa udp
US 8.8.8.8:53 68.253.239.18.in-addr.arpa udp
US 8.8.8.8:53 download.visualstudio.microsoft.com udp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
US 8.8.8.8:53 200.34.232.68.in-addr.arpa udp
US 8.8.8.8:53 id.google.com udp
DE 142.250.186.163:443 id.google.com tcp
US 8.8.8.8:53 163.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.voidtools.com udp
US 162.211.80.236:443 www.voidtools.com tcp
US 162.211.80.236:443 www.voidtools.com tcp
US 162.211.80.236:443 www.voidtools.com udp
US 8.8.8.8:53 236.80.211.162.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 108.177.122.94:443 beacons.gcp.gvt2.com tcp
US 108.177.122.94:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 104.16.184.241:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 google.com udp
DE 142.250.186.78:443 google.com tcp
US 8.8.8.8:53 78.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 beacons3.gvt2.com udp
DE 172.217.16.131:443 beacons3.gvt2.com tcp
US 8.8.8.8:53 131.16.217.172.in-addr.arpa udp
DE 172.217.16.131:443 beacons3.gvt2.com udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
US 104.16.184.241:80 icanhazip.com tcp

Files

memory/4852-0-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

memory/4852-1-0x0000000000F10000-0x00000000010A2000-memory.dmp

memory/4852-2-0x0000000005890000-0x00000000058F6000-memory.dmp

memory/4852-3-0x0000000073EA0000-0x000000007458E000-memory.dmp

memory/4852-6-0x0000000006120000-0x00000000061B2000-memory.dmp

memory/4852-7-0x00000000061B0000-0x00000000061D6000-memory.dmp

memory/4852-8-0x00000000061E0000-0x00000000061E8000-memory.dmp

memory/4852-9-0x0000000006FA0000-0x0000000006FAA000-memory.dmp

memory/4852-10-0x0000000006FB0000-0x0000000006FB8000-memory.dmp

memory/4852-11-0x0000000006FD0000-0x0000000006FEE000-memory.dmp

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

memory/4852-48-0x0000000007B10000-0x0000000007BA2000-memory.dmp

memory/4852-58-0x0000000008110000-0x000000000860E000-memory.dmp

memory/4852-79-0x0000000073EA0000-0x000000007458E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 9567b8a2c6101ae09c80ca6344d3a5bd
SHA1 cb403d712a505a34a4f86e8d46905bd913943bbd
SHA256 15a32654e249b14aa15f505547fcaaf8069bbd9e0007891290302caedf3d72ef
SHA512 2c7714efe48c9da3d2bcd5a2b063902a5044272df9c7489615562ff79a4f8c8558d80bf4dc88ec3aad5ae43a7606d2dd091b5a64e056cbce67d8aad185248e87

\??\pipe\crashpad_4920_PHMYMWLLNDNINIXV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8c68f9506a8170babd6fa1dea0a0c60d
SHA1 41019d03eacb7ef0b08f34e3494f9466ed59371b
SHA256 0c5cf22f1e7333c64513376a0f012bd054016bd380c343af07c515dbf1c30c49
SHA512 3e56e785b2679795279eabaf05076490b18296b9c334a024f68878f38c0e8d004a991ba6faffabd12cb9887294144d8074312c975c7ac788fcddd9a10685e98e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 70ac259273d6661c24fd1c980897d76a
SHA1 e77a40f79571bd82621ed988b01f7006bc10083f
SHA256 6a2e1809f087f792313aeabaa7013f9e37765f71c883674cdacba200ba869178
SHA512 d6cc8cbd567f6e8c5f0452ab2bc4fd176ef067ec41d8f0a50bc5c28bdd26590a7797ff6acd41c885032bf8abf8fb11f12e71e985471fa9ae44b393eae52be2c2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 814d4f34848582ef46a5302e9f51e724
SHA1 016d9194d421cef66d89224c9468449a9a8a714e
SHA256 943628ffadbd3a173e6b2f9fa89901aa20e81a91fcb532908e47be4e9abd0417
SHA512 1f95650389712bfdc3b488c5cebfa58b89b3189ef7e012df23f9fc8b628faf64bc41c277c312feb758ad4ec661a4c8dab9e241c26990338072640c6922233861

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 db43e3debe37793e1270022395fe3af1
SHA1 97c5fc624960b29cbbef05535c2ed9fe80728324
SHA256 f24cc45b1e2b63907eb92d9168aafa81dc516b1c4cd4160599c83f770ea60a73
SHA512 3726ea5e9e053183aa8b7e79a9e6bf02879bc24a2ea25c52d67d2030a7d15d216e600e141e52ba11be96e64b7d9df85e6f686f8ef816b67ea4abb489f2a86ce1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 14270e4ff9d8dcf1274352fac56aeee0
SHA1 27524eea812a995616626ee018b1f3bf4497ae87
SHA256 62039eab9c20275efd29bec9d3de4a9352b506f13d967ffe4a270a6d25edfb5b
SHA512 b11e7a80cc05327ceaa74c49067ebd1e3eee86df45b7f4396bfba2d9b8dbebe3935c8c98d42f0c83ecb7f50de5fe171b1317b7c911e3bbc37afe329a5100db23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b6d8a1bcc480654add9b5083bb848f3f
SHA1 0f24ac326edd6cf63c7891f68dffbfc39038e186
SHA256 48b3fdc84eafe0a4ee1d4ff74b274fec84a79b9f8b5f0a31a7ca0cd3b0752aac
SHA512 8989cb58ebd5d16af0734c8cfebfd44332264d4ff5a3c16c26e9877886507b8d0f1ce5023d2fff2c6eb3690b8853945c6240f5045edc1fb33ca57f1c3eb844b4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d9278b368609e225e15a629dcee23ae6
SHA1 660b1917ca8bbf50b0b6ca7b8ab6d84760389455
SHA256 c97678a331e2530fc7f2a99cf5c9a00f0a3527521a83f13a86196086b13b0eb2
SHA512 8ee13f79ded0f2f445a49fca889eb5f39b185a1501499ae213ac2938b02e32f7bfa82452441ae05be63505bd060524c5dd8b6c09280df8da7a34c3c838b69638

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 48da80069927515ae6b54a4bfbf1b3fb
SHA1 e49c811ac9b6116bae55a6374cab274d2d7f5c7a
SHA256 a7d9bc1c6284dd4f0ec30de4c5f5c255437fbbce7a03f8cb2465123b3e69a3c9
SHA512 b11f8c972d8951c18118cd4adf896940c625e0b58cac54ae995c02d1b508c0c516b0fd38ba296c7297604d981ce1f0f1d250aed7b88bf56ac9469b3decb90efb

C:\Users\Admin\Downloads\Unconfirmed 478669.crdownload

MD5 f55d52d5d690a8e1b2df9217bc3ddfdf
SHA1 0e45d3a28cc096dc7edc1208f7428d66335df11a
SHA256 59f57803fa5235075c3e470e1006905a61236e491bb75a599d862cafcfbb529f
SHA512 4101015760dd2b1d9cbf9586802e610bbe6f74b73bc5dbb4391417afe8fa20762a84b04cd15019b54107d8ad0e4fc523f25403482431dd53aec3d07a4b217941

\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\InstallOptions.dll

MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\LangDLL.dll

MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\System.dll

MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\InstallOptions.ini

MD5 e2808f4be298a32ae279ee9ebacd0a0c
SHA1 b7929c346ba7a7aa690a766e4f70bc1d44f75460
SHA256 99b98f333848dacc5df866402181a6e2441fff0f9cdbb2a26f5f2c5d5dd12c52
SHA512 a305986b1eb907caa77616bcf3b9929fcbef8156b9162a942b1720ae32b34e1ba0537c553b54e750a22c3106fdb33870c346dd1f9d72db7d0baa6d318c3752a2

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\InstallOptions.ini

MD5 ae3fa65896206b0aeb229e37d2e18ad8
SHA1 863d7ba7f3dc407d489a747494d5e1b3444d75bf
SHA256 accd11870265fb76f2db5d708e983b62b07578b89a8f4cc09f9b8c23b15b6863
SHA512 49ab7df624f0df72e176c53bc4a14102df5a784640420a2e0ebaf3a840f42e46733c35657ea8bf440c5340009a0569a1cb6f2da2bd8530525a931454fd7814e5

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\InstallOptions.ini

MD5 2663696f7c7b5391856ddcbe99ab1cdf
SHA1 89a178cf914ce120c252e47b332bc09e34c35eca
SHA256 68eff949931b2760f05a6e8cb89b5a8f9a8bde7b41e86287c2087b72fb03db56
SHA512 ffe15cb7ddf17e655fd6ab68410d51ba0e501c0dd14f93882588a59e3538fe0d6772f9ed0892ca8aeec4bad309cbfcf48692b3a831e85c7e0b9f60af9c0b06c0

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\InstallOptions2.ini

MD5 a6634dd375de49a06ff7c8c65f03bb42
SHA1 2834f907bb17d0916cfd1285718695f866e319d6
SHA256 caf045fdf50d8706410dabb4b4db6edab64d09a1c4229854666c5fdcbc70f35d
SHA512 c2d65ed0b99084753447711ea46e2805017b51917851bc7b53a96e58c49b92acf9f3f32fdb9b68beea400050703785ef49f7d7bf77131cb683663375654b71e9

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\InstallOptions2.ini

MD5 7a5cad47743f3e1e159d48d210cf918e
SHA1 c0082c46bcb6778c3e635520230e9193f73376be
SHA256 145382f2ac963c164e8dce6f29c1588f65e43e7f55291fbecb78f062c3cc03ae
SHA512 9e39d435f275f84f01496d92bb8c46d28828dd87a54d6ebc8db459768dab1deba3edc7cd5686368ad306027d87e46ac37f22af373ab27f8c806d665137c7748f

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\InstallOptions2.ini

MD5 8c669c70f0f9f6993b33f26d5394e65d
SHA1 67e1620a9a736e95d5b1f7be26a42306923871d9
SHA256 f8b80e729bf93456c8d448fece2fd4e0966992c605eab910b0ed7c6808d74f2c
SHA512 1c3e40cf6510651b58ae9da8bacb1bf68a0c95c8c918488d43340a4327f4d1da4241fe0e1d492bef41690b3ab43edc5351596619710b0a0b7aff9e161f38bcc3

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\Everything.exe

MD5 a7067594451cab167a4f463be9d0209c
SHA1 1c2b1e5a0826ca07cc0aa8b3d24bad0a41845df5
SHA256 d3a6ed07bd3b52c62411132d060560f9c0c88ce183851f16b632a99b4d4e7581
SHA512 8fb6e9a82213cc1c371eddc12833b8cad037b800a58a3a3520eb7b14c9e41e61a8bf5db27bd6a79dd8013c51649396feff22436cb7bacf64989552a5a11abbd4

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\Everything.lng

MD5 ba118bdf7118802beea188727b155d5f
SHA1 20fe923ec91d13f03bdb171df2fe54772f86ebba
SHA256 270c2dbd55642543479c7e7e62f99ec11bbc65496010b1354a2be9482269d471
SHA512 01d8dd2bf9aa251512b6b9b47e9d966b7eda5f76302e6441c5e7110ff37b4be325a4f8096df26a140c67bd740dcd720bc4e9356ccb95703ad63fe9fdbbb0c41f

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\License.txt

MD5 2d8c6b891bea32e7fa64b381cf3064c2
SHA1 495396d86c96fb1cfdf56cae7658149138056aa9
SHA256 2e017a9c091cf5293e978e796c81025dab6973af96cb8acd56a04ef29703550b
SHA512 03a520f4423da5ef158fb81c32cfff0def361cc4d2caa9cfa4d306136da047a80a6931249a6b9c42f9f2656a27391b7921a64e10baa7468c255bc48bd488a860

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\Changes.txt

MD5 1ebb92ac516db5077a0c851565b7a2cf
SHA1 9adabfbb11b070169429fd43a250285ee8881213
SHA256 e64b60048b375f0c7d4c1fb4329957a297f2e60c306ef9c380175ea7a42223d6
SHA512 3fba14d13a602937b8600c7d5cc8011f7369857be288510b142573e411b2296cdb3ce58beafdf268d04aa1c5130503a63ba38f87239fc7b0be2e0170bdfc86de

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\Everything\Uninstall.exe

MD5 fc3732ef603b36055209652f749c1080
SHA1 bd8b0806abecf983c89814ab4dcbd3300a78fe88
SHA256 0deee0d9d6e140226de19047c0ab160ec957a6e4bf63bb1c058bac9f09c47874
SHA512 98ee82dfe67fa3d5fe2ae3977b959b0fb1277e5bdb320e7eca347771cd4ef8d8b99c6b3cefc0466347e8f49644386cc2d0f5f7a63eb5404a8371182bd880286f

C:\Program Files (x86)\Everything\Everything.ini

MD5 b2b308d8c164f75bc11bccf7baf3df67
SHA1 6f1e5561268b2db5b46bb6f738c0f7a637fd6b6d
SHA256 f0969f438d2869641d8f76d5b9fd2b82c7232134a90972e96abb3783d1e2fbe5
SHA512 5cb56d715d35a33e5bbc7e7deb43e4f143e4193ae59282892fe72b82c66a21a62cec85222a9879d5126479a59b9a5e715568f4bb62040a4c03b706f1ebde9659

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1f1a644d231b9a652ecea1e1643ac0fa
SHA1 ce64ef897898d7372a2239ee1fddfacc44fc91bf
SHA256 ed87e86be57b900580f43a9f8c37eaf9015fb611eb007d220f5134dca6b3825b
SHA512 52b91196124983274c38ce6fac001811b1ab7225422e5dc2f674842edf8385489fb68df2fa8e23a4513aaaf183e545ea2c719dafec5fdc6371d159d07b84e197

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\ioSpecial.ini

MD5 b6e19075e9be3c30af47f7d9cd39df16
SHA1 048baa57f4f17d02c65c8fa7a27db9ccf3e91815
SHA256 5ec0b1bd2d565cfbfe39f120150cf2a5c1fd5bcf5618a54c60e188d106e03e12
SHA512 547bfcea448d996905a7022d62609c42e8fd15a62a91953aa820bb9a16b16bbb477dabbe6245521ef5fb9f1f36563ace9682c8927c77f8a245845c0ecd3495ab

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 6748f6e2df39901537b090bf902e7f69
SHA1 ec7cbcce455989177a3bb9bb9c65e700b6d78a7d
SHA256 4d50a068d19f58e1a45ab5f30c3fc43acaf94ff4d3e55611b6d7a53c2b5bebfc
SHA512 d0b39e9762fb7e7173ce946493be683a6d1e7f80af70235ec3f401b51f11fbdffe25142f723d98daff58b0af193c406deb1f6d953621d05dc491dcd3a510bb14

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5984c6.TMP

MD5 a871820b44814b01aa38f8cb60e68189
SHA1 25426efda2737bfc0dd052bf3e40b5faa16bf383
SHA256 d694db55c8b968952f3c5027402c02552c0a3b4326509cc6a2e2c7d018143af4
SHA512 951b7d35bfd28ae1c723ade358fdbe2f1e310583de8de8002331ea6209f077acc0192d8c5a8c560f455d7744e8e220685ffa533efbbeae32fc92b54ae7030ba6

C:\Users\Admin\AppData\Local\Temp\nsg5E74.tmp\ioSpecial.ini

MD5 7302a0629e5e8edbb025f771efb52c73
SHA1 1161876f2dea845840fdaa87c738a1fb0b92bcbb
SHA256 dfa8fb5a7918f26953c99b8c70e95a9a5ec0beb56149d840fd224fdfa2afd4b2
SHA512 9869db3187f4caafb88f8d4a7b6b782541fa95a5541824c049353ef7569ef098c5b0829a9f202e4299e71a38e8295ecf2002d9aed6ba40d2653703a3202bc3bc

C:\Users\Admin\AppData\Roaming\Everything\Everything.ini

MD5 49b6ff446eddaf88ea08a7c16792952e
SHA1 c0dc334f467d867f0e1d3fabd555ebcac395fc8b
SHA256 2fb724dd202047575842ab8b47f7c395b06c84879af5a1cd5978b3a0111e3580
SHA512 77caea2889ef3c8396cf333e6f99656cf087ba69e20f86279cf415e9b3ef598a98a0a2bada407443910ef24b8d51602ef3d1504f3826f0f9837d07db488bab2b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 376712d9b161535168b5e6671bd43741
SHA1 182b4aaf36ae5bb374a52baadbdf7172196c64ac
SHA256 7d081d7e7e7b32bb49337821e6a656edc77cab47fae9fe7c9b995e9455d88e33
SHA512 078437190b76a00ab3f21d2a146093169dde0256059f369c0da3ffee7af60fa80f215725a70228728bde199e4ff625f5e61627e92aa31e831d7cda81532f476d

C:\Program Files\Google\Chrome\Application\SetupMetrics\20240616170253.pma

MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 64e32df48efef3e12639cc113084571d
SHA1 2acda9acda0cadd0702c12564c6a42393f2f01bd
SHA256 9b76f04f43345b9d2c164d9af0e31b74da2279cfdd63cae7a93912e3a02bb08d
SHA512 0c1f53aa544651f8e2e7f6ce2eca025ec3ac2c3964ee16533f88cace93257c6bea76e7856a17e89a286dec5e907dc021c0133d2f94cd0f66366e9d9a7479660d

C:\Users\Public\Desktop\Everything.lnk

MD5 3316e0dfef89d2a188b6c45206f6cdcb
SHA1 60401db00eed7f5dbef59b7c66d8b737c8fe9775
SHA256 bfc909e41abc013ebe7cf1c72aab43df8fabdd79a2710d5f25352500e2f45d7c
SHA512 8fcce9cef42b876300a996b29ece0f65816e8d7405cc9dd154103d2f3f5c3dc6933e96f8e92f96c7543dcd3846312269a622d9327223c6346a507394c087314d

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything.lnk

MD5 a4faee4efdfa3370ebc23bde6d03ca2e
SHA1 dd8205eb923b4819d8ff8923f1317dc18b1ed82b
SHA256 4590f452e3f7a93bded868cf5f3e0f8b21bef2e887b9dfc8477e8423b2c98a5d
SHA512 acf59ed5303c3c8cd14d929d6c6a6b6f282927a55eb8735f5ce750a57209429c8b286d6c5e942c93b7d4bd147d0cb45370bb7ff6d4a7c5006857f87c3b763154

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 8e19f48ccb4f317296899e25e21b45e4
SHA1 62b38ba2bb4e038688ff551478374eb40c877c40
SHA256 4c318553b1a43a59eb5b8bc27b9b543348a50b6187497db451e53949064a1272
SHA512 8e46fb6bf415297e2eb7a32df486d82fe05d96ca3685b4e360c349deddf3142c4b7d641004323ea8daa748f2b4eb36e716e7eeb8d7f55da87c25f5ef00376d24

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 7e4fc52f42454b5786c4f1903d251e9b
SHA1 c2b15e474299640c7788ef6c6e1dc786ad35468b
SHA256 44ecf1afe51b47dd194347c7555cbe0056522a60e7a47d43a1de3517f9b9be5a
SHA512 494548fd330a79b4b25d0fe0d45aadc85eb91cad606ee3ba9b27dd562afa8d7368ff40713a6bb64218229432c805f01531a1aa3d93da07d30dab59f4eb483979

C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log

MD5 5ef2d728179e0d7545ecd92000a3836c
SHA1 6c457707bf9cfd2a74f76a3fde2914c1c1fba3f8
SHA256 54aeddac20ea96a169ab2392c77a7bb58ca2e4e5b43f106c10fa498f87d27765
SHA512 aaf635a1999c04ec7ab3d9cd55636b89f3b5f21d0ddc22572fabfb465dc1e818e8d3e6e21f4f2d45f4fa5b010dddbdcb5ff90bc996a6acd9c83e94a9ad012fba

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\Videos.txt

MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\Temp.txt

MD5 ec39cc4a2a2795305daf79b75b0ffe63
SHA1 20aff5b5b3e45388c450fcdc0b1107820c0601b8
SHA256 d4f945b0577b2d02be87bbeb070e80276fc4656890298e53f0247eec6f5a0946
SHA512 f7e089c7d788df61039d4fc7fb966cd72f5356e30a61c4aee240c9cf680f4f6e689369d66ac5dce5e1fd9b0a0a6b1b11fd346998ad1229e21d146424f45330a3

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\Startup.txt

MD5 68c93da4981d591704cea7b71cebfb97
SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\Pictures.txt

MD5 6ac37bf4745f9478fea33bdbf5dbea30
SHA1 64e04703c9d3b8e18cdb9fbc5c8fdbd000d58c2d
SHA256 ed1b7c40714af42e7e36513612d7c65b20aab72ac68f8f2fd3f578a199e66f3c
SHA512 587bc38775e25a4c66a1360d77e713a0c9d13f0b355703219d23cc67dd70bd4c73d7c43cfc4d2ea08ee163feca5fdd35781b2d275c4cc78b5d63a635e459f28e

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\OneDrive.txt

MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\Downloads.txt

MD5 411d93cc04d6bf04972017ba1ef5da29
SHA1 fec169e26f5ace9815a592d754b6e1b2d5ed6742
SHA256 c0d777f8169b82ed491275fceee24f614384b4d0630d146ae948bf6e9c40f199
SHA512 b0e1437c5bc20af2b5fdf1beebacc08b16bc2c1d954d7cd414ee24597e249e660038850fdc774b2bcbbd1e8e8385facc03a606d2e2e65b81153a9abb8c97d0b0

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\Documents.txt

MD5 f4a4ec62ef8c1454e313d75f83e1c77f
SHA1 d1091f80ac2cbd72b91d4ffee2350ed49807047e
SHA256 e05f09e0c36238d016c2ff3e274870c627ed90fd004e32c761708f13f5a0150c
SHA512 52ade355e6f272624031897fd100971b3080a5585bad70ee95793d08b088c1dd27a806389e364b0063ae5484562fe3ca3344350a5fb996cd452f1c8eba887ede

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Directories\Desktop.txt

MD5 e934b22e966b93640cc7807f52a88f94
SHA1 4fea7344a484d6651673ed69c775f97ac778ae60
SHA256 29c142a1fb484fb9b4bc092b64e9de6f1b11ece5c502610258c2e07bf98c1c6d
SHA512 37b2dd23a468a4fc1fa931ec857193e98e90a338b49db9d7a5fbec19f107b60a5bc8ac93aa59f50d6516c10eddffe314f9eaf2f0c744a685d8de7c3cb4a20e0d

C:\Users\Admin\AppData\Local\Temp\tmp7A2.tmp.dat

MD5 992848147f89ffb1c8c56771484ed175
SHA1 0d2f38d2f569e18cf37e7771376c42d430fb517b
SHA256 90f853eb9adc4d53d070033082db2d8d5100659e85ef477066fc450f68adb112
SHA512 1010f75056512235a122cac576634cacf7305a3244631eec80c5e6be1170627073cf24e955e5f23ad22bb74dcfe749ec3274f581ccd5d01bc788ea8afead74e0

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\Browsers\Google\History.txt

MD5 68833aa9b2c1935aa5ba7ffdd0fd6877
SHA1 c6170f3707fd263a94febbff3c0ca99b00ef2b1e
SHA256 1682d7fe74db0494c3fa4c0a4d412ea5af512d4f924655e52e369cf7b283728f
SHA512 df97184ea093851e8fb28f6b33c7a89cfc8e34d581e3f694431e5d46552848af178b4a797508228eaf749db98a637fd5a3d23bf41601d8542974eb99e48a6d39

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 5c857844dc3225123bcfcde84d6f1b7f
SHA1 1a814f319d78884f3b24698c9e1d9b746efa0bc9
SHA256 bb86f1fe3c0835121302ce4311a6483f8a7ddbff3311ad2c80a840967c1a48a8
SHA512 935fad11f3fd17b69620557cc094852a11dcdcc58e35fa802ab858c2a7003c6993fca61337674b212a5f2ac767a1187f1bf78050166264d6960811fa8901539e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4f69c46efce9d7a13f1115ac4b5b28c6
SHA1 b05a8fde7ef8879c0b51591465ad7143ee3d76c1
SHA256 354562f1650b4ed42580a4dc6a1b8255bfbf3b64d42477dc7ec5cf0f949efbb8
SHA512 6551ba3205ec5262aa509561e4394414e661a7d94757579ee41112b348ebe40aeacacc9bc32e3386f5ee6b90b0d05f6f640bf8613df0a24abf407eb2dd45d1a9

C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.ba\bg.png

MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\.be\dotnet-sdk-6.0.423-win-x64.exe

MD5 4c7cad10a74f13a58bd3013963a1f887
SHA1 8508ec50d90b5fe21c5003952a1f9ac0240e1326
SHA256 ca23e4f48b8cefd7c550a4a2b347748d1ac2cb0eb4ec4e86f37f71f0a2844edb
SHA512 4ed13af7715aec3d96a58c8827581910b7a779185aab589664f1c55e942c6a9abfb77d0ffabaf62d33a3c36a29a81eac06914e2e3b6625749b0a487d43dd340e

C:\Windows\Temp\{D47179F7-F09B-478C-8CC5-56B46F530BB6}\windowsdesktop_targeting_pack_6.0.31_win_x64.msi

MD5 eca02c103af5920b59fb11cf7b43f336
SHA1 fa12b91e6b5303a63b68583da935d94f95dec794
SHA256 8a9a09b4e520653a1f8c01af7bb4ad6cf560c61efa6c2defaa96ce565a60296c
SHA512 90744db81900505079cc101d69633bca2dce38b58f32264197f671d93dde09bfc63170f21b39a39c5f451dbcb79255c92b47d5a9b00ba05a744160ca33cf6ac8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0d824385fca48cec8bb5e63c0c408a5f
SHA1 23b4b98f2b3b85260545ae151a11a65431ca3adc
SHA256 61f86738c3872ef7c869c10f226cccd11d34b6f9b43f06ff7dbf146e2f67b93e
SHA512 b55dc79102d8580d0dd48bfc6b7b24a2a126eaa1334bc54e970f9421d0bce103a215c52d59e3c15f700d8b64506a82fc5d1b6ad9ccc5ee5f7814c6571ed38c17

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 a647200fcae34d15315344dd264c44ca
SHA1 658d23193eea241366b0a9014b258b401437f1e1
SHA256 297caf773d6b3fda409416970883670d9c6e6635148deace5a9f2658304c3f30
SHA512 90388fa965233cafba4da2291eae4ed25b7ab2640e6c7003a07a366933152a7ef7ecec8515ff1297e7b37e6ee2d82599d15e44919243a4788173203cac45256d

C:\Windows\Installer\e5ac0c5.msi

MD5 4d10d348f094ecd4a64e3338a2b151e4
SHA1 35c4ec16ed624008fc85b29f54180c3345538066
SHA256 48f9d9bb52b4960852bd67f1c514c88828fe7d9e1de336fc8146c2d1e7c1cfe1
SHA512 bec678826f8920bae33bc09355bcd611fb8b8c3e645724ffcd93f093754352d424f38ebac33568026daf7c94ecf4ced20a9f9644b3d25da1e55208df812d57a1

C:\Config.Msi\e5ac0c4.rbs

MD5 27f6334f49de405a87e9635384bb7631
SHA1 de08386da77d327582dce0b1c26ae9f4e4deba00
SHA256 27f48387172fab1465965962a17541941fd35b8c5a5164e18204a3d6f4a91062
SHA512 6059d88f2d74b1149e2a304f91e77a851b97cae98c45883a6fc0b8bc6a1331deff66488c0c15ee22cf7e07e1f33bbafab6f2601f2460e5f65d118ab608649b7f

C:\Windows\Installer\MSIE6BD.tmp

MD5 60e8c139e673b9eb49dc83718278bc88
SHA1 00a3a9cd6d3a9f52628ea09c2e645fe56ee7cd56
SHA256 b181b6b4d69a53143a97a306919ba1adbc0b036a48b6d1d41ae7a01e8ef286cb
SHA512 ac7cb86dbf3b86f00da7b8a246a6c7ef65a6f1c8705ea07f9b90e494b6239fb9626b55ee872a9b7f16575a60c82e767af228b8f018d4d7b9f783efaccca2b103

C:\Config.Msi\e5ac0c9.rbs

MD5 be4fecaeb91e84f522c15efe92866dc2
SHA1 5a437683e676c580ff8a9cd78f7bb4d3c56859b1
SHA256 a8a86db790e63f87b4543aebfe4d51cd789a86e3ac4f0ba00994cc9e99aecf4e
SHA512 b4a48121b83f23f468cb4625c5a23e2cdbeb190ee05fdd909488acbf88dd8a3906a84b441a555eb3d7a230dfbbb5529966d32e01c0becb3bf2017bcf9be8b02b

C:\Program Files\dotnet\LICENSE.txt

MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

C:\Program Files\dotnet\ThirdPartyNotices.txt

MD5 f77a4aecfaf4640d801eb6dcdfddc478
SHA1 7424710f255f6205ef559e4d7e281a3b701183bb
SHA256 d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7
SHA512 1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

C:\Config.Msi\e5ac0ce.rbs

MD5 8a6f9b2564661db6934e55e472c784a3
SHA1 9a534bf6388637e45c5030a16d4c265c5d876a07
SHA256 62c955004334afd5417b340c52b06d8ac6c5ddf71bbec1a804f33864f9a4a0c6
SHA512 092e4b600c8f5c90d3dbc0950557e3bbcd164349e999234720d5aa5b058e0d8d905afdc4433a3f31b9b49a8c1412f9e9fe7a36e68f65af2bea3e59cfd7664a59

C:\Config.Msi\e5ac0d3.rbs

MD5 70440798c735dc307b68e38940e87eaa
SHA1 c1af2676f115f012073438aa4c1f1b715ae90564
SHA256 1f4fc58c4db3997167b231618e79396900551dcb67d5d9b9f9e20806fa01bf98
SHA512 a6d97c7500003d5856cd427e5312323c291290e7dd4d2898b313295f8a0d947369602829f8a29688e5d393b3cb8cb8f5c757dda402e2c2612227d05b7000ec23

C:\Windows\Installer\e5ac0d5.msi

MD5 5bb6e399972e7689172feccd314ca8fe
SHA1 f1b8d184d350daaadbb637f3cda338db973efc5f
SHA256 6cd5c2da21da5515a335778b426435762b19523e7ac99fad268c333aab8b9655
SHA512 dce99a54b61c0313787c2f7a05b8ff7b5c1679d4518d2f70e234573a94026b1776da917852351ff9e1115f567499e4eb28e257501114ee102e521f070a13a176

C:\Config.Msi\e5ac0d8.rbs

MD5 9b99c731ca9e7285e8ec24e0cab6561c
SHA1 f0736cdcadea0798b21f161be752ec6443a8f31d
SHA256 b2dcc466bc4fb0899fa57f10eb8aa56f1ab9347e1e289fa04a59fdfcbbb4e081
SHA512 495c9b9e6c5ca69753614792c8f9ab3c86b6304d055e3ee5860bc3aee7c3f07d5fcc7b7b54627e6fe58117b1173f819943d5585a4f1fa593e3a2f25c83650118

C:\Config.Msi\e5ac0dd.rbs

MD5 0a15ae892361e3eefb2389561b7bed60
SHA1 a636b84a69d766e41491dca2d199cf39429853a5
SHA256 831c6722fefb225f64e19d2cbe4e8ee56fbc5aeb05804feed983fe0cae3a3076
SHA512 81488099a42ad34320b4bb6515a885d9925f59022a30a6a9f3f5f0416e06c7ae96343354270879ea5fa323228b619d469180295979b262aeab282ccc3959ee02

C:\Config.Msi\e5ac0e2.rbs

MD5 3ae0b8ac4102c65198425c733188e552
SHA1 5442e4fea9926e4548e9cbe90b80243d3064fc4e
SHA256 836541b554b5bb220126ce9ce72bb9f5a70b6bef72aea7c1bf30983bb265d2a8
SHA512 2be30f7154a188ddc94d8f58e30b773f1e8eb72b2d2cb4b2e1b468c57556275c76161104a347f1b26d1e262105485fadf6c5ec51c2581c3ac367f5a219fbbe23

C:\Config.Msi\e5ac0e7.rbs

MD5 23c1c3f063a6a7c1ead4b42b7d5dccd0
SHA1 8e1fc55d003dc9d01dd4efa6efcd7d1914a6fca6
SHA256 73e5df282992e3e7c34b4e4c1f35e8eac4bac1f87382b290d9ad5c092b246d01
SHA512 e00ad3759f14e8ffadceae1b0a2c735ea9c03fd94a49e543ab19ace587294ad17c04fbb6f3721e6b5d667cd7bef36101c1e71a8e3d275e9f2dd7cdb930730040

C:\Config.Msi\e5ac0ec.rbs

MD5 2a4ac107f0071fbb17e455119431bbf6
SHA1 5fcaf7804074b7c21b7168e1b361794ebc6059ed
SHA256 fcedfcfcb158071c55ffa72fdcdca2696d057645213dddaf5163c498eb4c0208
SHA512 14e2376308e92f45c5f897e3c162b3111564108def32d079ba1cac62e593dfa48e6dace30f05c00fdd34c3ba467aad5772f2ddb949994ce9e8364616a45e268c

C:\Windows\Installer\e5ac0f2.msi

MD5 7147f19faf4e1fd3aab745b2cb41224b
SHA1 b83f0686e7c1c0bb4f5e36648b20aabab4d61672
SHA256 ca3678ef53f5080590b9cb22ed66ad114d299c2a777b0bdc75ccec6972d873d0
SHA512 8e1a32febbb1d57da366d23bd3cc5b5db6397578541dcbd3000055980e28514b6d76e5a42906b3cab678ad71825702906d02c8422f0e410c6a2c9a297826d493

C:\Config.Msi\e5ac0f1.rbs

MD5 398540ab30cc152415273ca91936bd04
SHA1 65bf2680e638978989cf41acd9db88f27b7f091c
SHA256 89521706b7a6bb72df55e4d8d7533f9524231e5e36f166cc5eb13e7092c375ca
SHA512 43cac262f2f9b54a9bf96f7c96104ef34644ae521befc48320cf7f617a6cd5aa690d2af704e4d13b0343dd862603201c532a9cf87e2d4213b8880f96ee195ad5

C:\Config.Msi\e5ac0f6.rbs

MD5 b35bc72c037b87c3241df1f5eb2ce264
SHA1 6f010d4c8227e69ab9129be83087adaa375893d7
SHA256 6a0164a3f3b875b8c667bb4e075058ce74fa72e14d8c444460dbd1dce443a3d5
SHA512 c52da768839df2fc348db3b3a401a1c79fe033ef611fd53fe43878d6acf3c1cca03339fc383f71fe77297bf825221db6e7bb1c95957e278ba5a934f31508b070

C:\Config.Msi\e5ac0fb.rbs

MD5 7212e91cebd7d843750f1b2aec6ea16a
SHA1 be8bfee3ecd3832ce15cc46ec5ddd3b774ce4b7d
SHA256 cb9db130e99bdc94705c40ec5d6d3afc55d550ba453b614b8f96c5fa89847885
SHA512 e436ca074a10b2510d9083b2caf1ecac50c3ab49139736d0ea144e443587b08323f1636fa9a99bd2caa08fe07952df72bc2204d473f661b57e5a991d098cce50

C:\Windows\Installer\e5ac101.msi

MD5 34444229e26dbd92331261a9106a8cdd
SHA1 a7be770ac6f9f2b038547734e7c739e118b094ad
SHA256 abf8f57cc19e49c3fb31911c59112496db58d2db07cc9ded9651c8b95bc9e69e
SHA512 1a350f22d4afc51f00f2c84db64a8d0f0aab19b3c8259a3d7d9c792b02872f67aba2bb390b2b174bd0ab3ea9a4bfde25f9b6b29bd0cb6cae67eec782558c17a6

C:\Config.Msi\e5ac100.rbs

MD5 2a34dba92c6e7a59f368a66d550deccd
SHA1 732688315689ba2ab3c1dd1a8983f46b91ed8cd5
SHA256 36cc1bd218178941eb0ae05c37158238b9b0822aec918623e6c2fcaa213ab723
SHA512 80ccb5166648fcb41e91ce0598ae66f57a2e560f8fe2560e6b3bb414fadf024f5a93a8cf07b72a1c4b9da173e69c9b8e40ec11390764f2b5e1f2f1e823bd3e0d

C:\Config.Msi\e5ac105.rbs

MD5 b66c8060ccda56a13be4e53d8b0dd295
SHA1 5e4959068aeb1b5eb2119cc153b8d9b8cac504be
SHA256 c79f8a6296eb4df187ea3db43ec7ff8bcc27f7189d3b8861e9921a724fa23d00
SHA512 ba96dfa2f59497719a483ff42399d9e9adca7590607e66395bc22cda62c76bb3961d2ad9dc2aff0801831c71283d64a0eb6114c28d71402deab76fbcd92375ff

C:\Config.Msi\e5ac10a.rbs

MD5 392581d73e9ddd270e30858af34fc75f
SHA1 a31eb5a5971ea9ec0ec3900ebe87950c6f0240d6
SHA256 36c7b14f5f9b1acede933d5d4ea9a336be1046faa57e16ccb9199e9ffad36be6
SHA512 15a087164a9880b321f46d7f89067fec4b92946b5ac26679f27974900e4dc655667aadca4f6f13492f09a18720f4fd6bae30bc20783de0bf8c2d4732de56e5f1

C:\Windows\Installer\MSI77A5.tmp

MD5 d711da8a6487aea301e05003f327879f
SHA1 548d3779ed3ab7309328f174bfb18d7768d27747
SHA256 3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512 c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

C:\Config.Msi\e5ac10f.rbs

MD5 94a3ae3cc813b8ab619357c461aaa71e
SHA1 5f3e9e708194a11288eda29cc376731f131e5eb9
SHA256 181dd4f0710b020ab73f48147843bb1ee998bdd221c42b7a2811f5d7fd45db43
SHA512 7cd1429765ab2249412508a4a1f4379ea6d803dedcb88cb3ca4847bb2cfb19cd3857d269f115835c126d75a40ac44b30abd4b334c8146a76abe3970242cdf93c

C:\Config.Msi\e5ac114.rbs

MD5 033838efda9d78ff3ed65773a978cb42
SHA1 f2c82941ca6dc8151962730e0a42ced7797b4882
SHA256 e5d775234362278b672e50a566a0a30c83bd68e0777078ae327b2b39e1853e13
SHA512 3d4177e84ca20b5fde044f3ffb704e95c648df85bccbbe2bcdcb823ecbcf5f12c925cf66df156f8ec413e37d7fe6c3476ddb29169e8eddbb54fb1d2a66967630

C:\Config.Msi\e5ac119.rbs

MD5 6ba2750d72be5c6576c1e86a68052c08
SHA1 76870ad7adbf0d79a88053c48b4a233ffdadce01
SHA256 612af3daba268e8e50683f13fc8054f0fe1a992ab317dcbd99d32715f3d3c5f8
SHA512 995dea2962c37c4fb3f2ca965196f226e11377f8ef6f0f4b2ba76a58fc67b239eb76bb59c65c1f799596651a2afe10e4b3aa6f3a0952598692f92f782bfa2fc2

C:\Config.Msi\e5ac11e.rbs

MD5 2ebbbf6f163eee9c320f2ae3f6675fe9
SHA1 c7c74df495109ce0ba6e0a0cd6191273a8a0f15e
SHA256 a3cf661647a253f98f5fc08538813a3579b144b9f049bc162eca0be7c1d8379d
SHA512 99ae58262c680f470b36573127f8325ba4a788337cb590c2e9813733b8c40f47a41fec824db4b24f2d3797fd026322fb3bcb1baf90e5cc9a2c3f39f3dfc151ef

C:\Config.Msi\e5ac123.rbs

MD5 c860c2386df1109718acf81dde6ff889
SHA1 ee817642df5ced5f4935cbb48bf87024f7b60073
SHA256 089a33bdf7636b55d25763d407bba3a3553a221362190be25423f55b29017029
SHA512 ad97875cda13d0454173329a85f80b1148300463a535ee35cc6a8abb815709a2930ea0b8d85685acb70c464afca00cdcce9c200526eea9eb16a07cda11e48f43

C:\Config.Msi\e5ac128.rbs

MD5 9308a7f58951ff47e82162e0c56991e5
SHA1 7a0eb7480ddfc75db04d897d550d1fd4de158e5f
SHA256 62efd89bd22ed6817bcbb90b8faf6e8fb5b01628ecf44cc7208ce6ec172755f1
SHA512 7d644d666c721e76703f8ff71b4a7a955d8bba5e91c34c3b6dc7ad12dd617cdeeab7d7e375b51fc730a8c803a7bf9f799ff90c71b7c09c3c8fdef0f4d953b91b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 8b47fe92c898f9867f0314aa3fbedfd6
SHA1 6777e7fff8d40bab20d1b3c9f4316cfb2a3ee7b1
SHA256 0591569f58b00c7b91b5c5fc25f797d562e46b5af9431cbc43c0f9dc3a504f71
SHA512 1447b9db99435d3fa8ca4ac34d709aed2529cbfaa8e11ef0fb04fcf6495017c453dc3559421d2714a778ca9d436bf9717f4eaf9dc91046fb539e111d5f3122d6

C:\Users\Admin\AppData\Local\Temp\tmp5879.tmp.dat

MD5 a6f011134fd36bdfb9cb20ac44ef8726
SHA1 16ab2be4e55aedfa4ee35c456c40373b2f396d7f
SHA256 cbdd74e567bb3c2a9a22daebe5e95675372557b54faa891f99389d81be37c307
SHA512 75c3381fde99053b99a8e9174a9fb868fe165a33b51f749e2ad21970316e7612c044fd6381673716a4654e08f96c2ecc647e66a10a0f0e43781c6d2ee3fc10d1

C:\Users\Admin\AppData\Local\Temp\tmp58B8.tmp.dat

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Temp\tmp58B9.tmp.dat

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp58CB.tmp.dat

MD5 8f4fbb32b8dd324ad03a5c12f32c9ed7
SHA1 443e1ee126dfcbe86f2018e7d6af2b89d265e8b7
SHA256 afa5bca5962642352d2e08aceb62e4b52e09bdf0659f21b95b1b2b3d51684ef2
SHA512 7c452c4cd01dcef315aea99ac804bf038efb2e937c64e306490f375baa7ba946e3f7b338c27b4d6187bf53defd3ec2b9e47538246230003c16b3e873c6dcf266

C:\Users\Admin\AppData\Local\45177e7bbd25cfa67c13e37c061b2cc0\Admin@GKUTWGDF_en-US\System\Debug.txt

MD5 bfe32ac85c30a5bc6f3a11d34b24802c
SHA1 48983ac7e311a3bab0ad3ca62499f1ffe45f2fd1
SHA256 6b08ead4da0a1049e7d0d3f984bbafb8dabd329d362c28e3dd00531e9cf4af4c
SHA512 4a19f65b952b09e4f186a23a58134023dbd23fd32f8d7c649ba6eb74bd3dfe1b2c0c47cc4b03a9a385d8a3cabd7ee409e2863fc43cc7260de4928992d54a1b3f