Malware Analysis Report

2024-09-11 03:36

Sample ID 240618-yt921svhrc
Target 315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf
SHA256 315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf
Tags
upx discovery exploit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf

Threat Level: Known bad

The file 315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf was found to be: Known bad.

Malicious Activity Summary

upx discovery exploit

UPX dump on OEP (original entry point)

UPX dump on OEP (original entry point)

Possible privilege escalation attempt

Checks computer location settings

UPX packed file

Checks BIOS information in registry

Loads dropped DLL

Modifies file permissions

Executes dropped EXE

Looks up external IP address via web service

Enumerates connected drives

AutoIT Executable

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Modifies system certificate store

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

NTFS ADS

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-18 20:05

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 20:05

Reported

2024-06-18 20:08

Platform

win7-20231129-en

Max time kernel

148s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe"

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\b: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\g: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\w: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\e: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\l: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\n: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\u: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\x: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\z: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\takeown.exe N/A
File opened (read-only) \??\M: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\j: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\k: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\q: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\t: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\r: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\h: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\s: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\v: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\d: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\i: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\m: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\f: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\a: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\o: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\p: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened (read-only) \??\y: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\SCFGBRBT\root\cimv2 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\SCFGBRBT\root\cimv2 C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime N/A
Token: 35 N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime N/A
Token: SeSecurityPrivilege N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime N/A
Token: SeSecurityPrivilege N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2884 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime
PID 2884 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime
PID 2884 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime
PID 2884 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime
PID 2884 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe
PID 2884 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe
PID 2884 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe
PID 2884 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe
PID 376 wrote to memory of 1124 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1124 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1124 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1124 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 1124 wrote to memory of 732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1124 wrote to memory of 732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1124 wrote to memory of 732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1124 wrote to memory of 732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 376 wrote to memory of 1588 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1588 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1588 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1588 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 1588 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1588 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1588 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1588 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 376 wrote to memory of 1196 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1196 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1196 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1196 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1196 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1196 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1196 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 376 wrote to memory of 1708 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1708 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1708 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1708 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1708 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1708 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1708 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 376 wrote to memory of 1744 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1744 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1744 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 1744 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 1744 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1744 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1744 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1744 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 376 wrote to memory of 2984 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2984 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2984 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2984 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 2984 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 2984 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 2984 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 376 wrote to memory of 2180 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2180 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2180 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2180 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 2180 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 2180 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 2180 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe

Processes

C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe

"C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe"

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime x "C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Download\grubinst" -aoa -o"C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358"

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe Setup "CleanupDir=C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt > C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.output.txt

C:\Windows\SysWOW64\diskpart.exe

diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt > C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.output.txt

C:\Windows\SysWOW64\diskpart.exe

diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c takeown /A /F M:\bootmgr > C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.security.output.txt

C:\Windows\SysWOW64\takeown.exe

takeown /A /F M:\bootmgr

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c icacls M:\bootmgr /grant *S-1-5-32-544:(F) > C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.security.output.txt

C:\Windows\SysWOW64\icacls.exe

icacls M:\bootmgr /grant *S-1-5-32-544:(F)

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt > C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.output.txt

C:\Windows\SysWOW64\diskpart.exe

diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c C:\windows\sysnative\manage-bde.exe -status C: > C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\encryption.status.txt

C:\windows\system32\manage-bde.exe

C:\windows\sysnative\manage-bde.exe -status C:

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c C:\windows\sysnative\manage-bde.exe -status C: > C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\encryption.status.txt

C:\windows\system32\manage-bde.exe

C:\windows\sysnative\manage-bde.exe -status C:

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 sourceforge.net udp
US 104.18.37.111:443 sourceforge.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 downloads.sourceforge.net udp
US 204.68.111.105:443 downloads.sourceforge.net tcp
US 8.8.8.8:53 unlimited.dl.sourceforge.net udp
RS 185.119.90.247:443 unlimited.dl.sourceforge.net tcp
RS 185.119.90.247:443 unlimited.dl.sourceforge.net tcp
RS 185.119.90.247:443 unlimited.dl.sourceforge.net tcp
RS 185.119.90.247:443 unlimited.dl.sourceforge.net tcp
US 8.8.8.8:53 drummerdp.synology.me udp
US 96.240.1.124:21 drummerdp.synology.me tcp
US 96.240.1.124:55596 drummerdp.synology.me tcp
US 8.8.8.8:53 0.pool.ntp.org udp
US 208.95.112.1:80 ip-api.com tcp

Files

memory/2884-0-0x00000000008B0000-0x0000000000BCD000-memory.dmp

memory/2884-11-0x00000000008B0000-0x0000000000BCD000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar481F.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2884-78-0x00000000008B0000-0x0000000000BCD000-memory.dmp

\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Zip\zip7za.runtime

MD5 9fa07f7b0ffee060b7ed69f0e028b03f
SHA1 24d4301baad23ea6b35004e63a93bfa6e71b473d
SHA256 bb6b9f15ff2fc1b938693be31965d50c23bd79244c013f0223f2e39fe08944ce
SHA512 aadba7515c0d12fb6be584601806037105a17d556968d9493387c2868d9e33e008a02417db1e1b89e66362d94957d6f40bd139f6305d5b01461e94ff99d835c8

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\Download\grubinst

MD5 e93162cd949b8791d2fb81751972dfa2
SHA1 9e4f02cb6dfa9851cf36b28c43457281159ecd49
SHA256 3f86fa99a20c2f5cb5751ac046bc93aeb9037d1df4cb804b30a58306664d8625
SHA512 3bd1ad31a46d91c3543816ce0e66d402ee1120d6aa0ac43c3e2368be84c5df9a95f68ae918f12762ba4cfe22d5f643844471667a0b71fc26ce5f9f8cce5ebe7f

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\locale\hu.mo

MD5 40242c1cb16f3ca91dbc278522391412
SHA1 8ff6e98dee6f239a14eb725bcfd1c97ba556bc57
SHA256 9033a4326ed2ef8923e47b87f74996f8677ec848507fe1aa4d82df0238afb2d9
SHA512 89247fe240d06871510465c0dbfa8c8af29e2198557af6693bcccaf3d0c54487745dcea4e73d63afa7ffeb17ca8aa8c1ce6d9f1f29558087756272ad22c9ccd9

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\locale\ko.mo

MD5 04a03fc01898738cf312c1921f7c1b83
SHA1 5f8db136a0ac9a51c2f2da83a17f53a4c784a089
SHA256 9462dd84639686e1596075b4aa6dd30539b0e60668c786e3441084bb75b57417
SHA512 f27cb7c99ea994abd3a5f76f0017e51230aae97f5cb04be3aa6b7d65d509a54a23ff30521342ca18c03984271172acc69820fe2f9ae0c86042109316b36a9aec

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\themes\common\colorsource\snowflake.png

MD5 2928e41c326b8e24942885db0bcce0d8
SHA1 07f3dae39eb94a351d7b2fc9291ffd6808807228
SHA256 9c3b8372be727a32f864eecab9fe78da10be50b62a2f59e1c333ca01c649ff0c
SHA512 e1a4f2562d2fa2e5c20dd6e847e1bdd10b4279f01653bab1b438c89b7b08ecbb733097b3439e299aeaa4efaae90c2563b14a9c69ab31961899b8313f9c483656

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\themes\common\colorsource\radian.png

MD5 54fd7851317f76824702f27ce73aebaf
SHA1 dcaedcabe71b23b816d5f1761f9c4a8eec5f5588
SHA256 ef789f0038029b55141e1c89a9879f3ec8621f3e416c32847972dc0d30a31234
SHA512 6f5841f0cb9346a86a53fef0b6151ba113733920c2ea044b10f9940e82de2eb2af7975aca4593a84069b6bcc58b1224c653b0e74acb045b2fc64a096cd87018e

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\0.png

MD5 0df2a89e2fc183745a4a933573ca3661
SHA1 6d6a1d28a1464a0df5f6b4f98dc3ce6309d080f4
SHA256 e28fd0c48b9bc579ed66b23efc92e7b071592c8a93ac281bd35e0ada195b3ec6
SHA512 cf9a57a8718643acd13c4e52fd381f1a06d6fca6de8869bffc711596d3a09ba4aa8e555aec5070718286a617fdd32910a711b29d575229b793430194e1752322

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\1.png

MD5 51d00dd365a4e751f03137ff4650246f
SHA1 bec678099aa192ddf29b44a26a48ee744065461d
SHA256 bf166874102c79b51a753814607a6c61ca84b1a481fcda4cbb0f11b2313bab8c
SHA512 edba25e081f4e5ea7efd2a811e5ad1120c2360f6f29ed37477b62599160e2553e8a71ed07a651895aed8e5dafbf0d79b7c2503bb8e8cb4aea6aab1436810081a

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\10.png

MD5 97c1005c5222ea8768c0eaa0eaef0720
SHA1 0b49ae47e365b169ea36701122a77bbd1ebe57d8
SHA256 3f1133fed577fa5b6a30cb3a33b54971dcb385f50576f15a75608530cc80fe2a
SHA512 81ff262ee8fa50d03ce07f80eff61ba01ff075cd868c0c3b96749f53f1187f9463bb65a42b6b496aa5cbd68a77fcb255fbdf4946a50fe1bc40ff44ab3630ac59

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\11.png

MD5 6fbab54dc0a4998230f8bc5d171d3cf9
SHA1 dd3a235951366dc3c6e718221f3a0e8b9f6abb4e
SHA256 8d49d2d6e46def8f9ab8ade45c0dd3d53d84bb5fca51a278fee24230374d0c83
SHA512 de0b3666c8431d541f881f362cc54b00650311db0489c8dd4f37eea27409434ce537d2b634a045bd4bc758e55abcf76154aac03c4acd417bee45a2198f29c3e3

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\12.png

MD5 d976126624684569de1b9eebce279211
SHA1 7eaccaabccf9a055d89154f04d4f21506d680381
SHA256 330538eb0cbf8dabd56a19c770a08e69027dcb3129c11f719f2c0dd7bcc7dcb0
SHA512 6a351ab2c0e1cd9eb4a6089a4a9137e005299c850f1d5fe269fa52290a51d866be1f3c289c2b1bb3bfb291c2c307bf711d7307b4bb73ce7c96ae3844444ae259

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\13.png

MD5 f7c5136334675cbbbf472d88edd07c86
SHA1 ee3db81b274c256859f69491a1d7c584c91bbe75
SHA256 82dfa3fa3234d0224a20b0481e6fa718f10baad5d0e028e50efcbdc9757f47f1
SHA512 62e2329a4f4c91865aa6386da8f9a53883163c577132b1cde2c86d01e4fa7ad6349bfb74902899ba848945f4e48cfe1d0983b1fb0b527b978b20501108b23906

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\14.png

MD5 def267fe65d7d4ab8b1ecb39439ccefa
SHA1 a53aa17c48ed31f71a8ce84798a37b1bcab7f5f8
SHA256 5f2468ea24844d0b4333c3a007c3097b92bc46a3bb03fbc50d00e857447769c7
SHA512 ee45aa47713059c00505e39c1cf92a0a893493ec4140dd6017c23f01342acd006d5639e48a4d059e66469a73f861db2e776ebfecf02f12e3d45649e0d9be3ae6

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\15.png

MD5 8d1bc59edbf35e178a0d8d466a7c5aba
SHA1 6f109d15848e844b2ed15f224304c4adf5eb705c
SHA256 bb62b6c1f983b342e98111e205a303411f24447cdb5827678c722280718cdce7
SHA512 68315d3ba79a912989a7eda7024b99c8c79be85527cb3ac6b240fd0d2d9596f2b2994fe6ef8a091ee50db932385f9d969cfb4d7e3c735760e0f7099796bb62a4

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\17.png

MD5 0351799a21ce9d3968b384f095b7d5c8
SHA1 16062b17a05c27a1c29b44394d1360f25ab6b819
SHA256 11d654eb2b8788200c12a4fbf175534fcb3eb6bdc892f68f015e15083a193c17
SHA512 65f045efcac50b90803902c6bed6bd5be6957a7b5c5dddc591850f71e62c2caed24be119e5623ccd711f587949b0cea21c56c42ecac8ef3ed903a7522a0377c6

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\18.png

MD5 4e4609a5f6c060b25ddf8565b5169897
SHA1 c23b1245847b482d413dd80dbfdafd922f23db86
SHA256 230a24f9a6d714793ea2e35dc73bef51e66ceb40a497d226f877dcac5452dede
SHA512 4123883051aa00e8a7ec249a3e13e6b9e87b6492affea479048c6fc5c089893778a850eb107c79c62a18b2a72b44ef91db22780b2e89079bd7798f6476a7f346

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\16.png

MD5 6dfa8f6b212ddccd03860ca89a69e067
SHA1 34adef80aee89e3f81ebfa404d57c3822ebb6af3
SHA256 7f37a12ba62689af22d2866f8907f475d93a6798572dac54ba2538d12f4c8903
SHA512 c05bb2028bd2e9fbf0f1d66739cfd582a89afcd24feaa348c94e684e8bdf22c2b8b82dd4d978bd1294ab4a4611ce7d3ffc90b02ad92c08962fe0fe9c0949a9e5

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\20.png

MD5 2dcf566260bb90ed15cb9be9045bd6ff
SHA1 7a4429d54dceef8d91749aad21794031b1767c50
SHA256 caf95f64db3d13a991bcf1e0d65a9df60e8fafc21bc8a0d56404ac8ed5ce8374
SHA512 f345ff76e827a71a9ea306bcca311aca329453c652a9d6c09a0ed6f3a02fba0a22bb1db6ad5485bc52eae96e74e08b9090d8d82197a170bd3b0e32357fd1dc23

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\21.png

MD5 9a30d58431abed7dbe48a416e1a459e6
SHA1 faa6a8d798b644e7aafc21bf94f29ff979197990
SHA256 6befbdee672fff55cd15bb65190463af0c4ebd41ab7f5591e7472d3d9b52c325
SHA512 bd2b0ae99af9caa60825c1a18c0533c831c7d8e113b6ea579485d03f6660b7e7553e5dcb4d4f129e7c367b3cf306525fc0e1ee4500ddb4b5fe01d8507d726ad1

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\2.png

MD5 6441bc777463e9737e5ffea8bf6aba70
SHA1 79eb3d2e439715dabcbc75873bcbd827ab4a49e2
SHA256 83b0515460d543934aecc85adcbc54f75bde0f16599ea6d279e2015608259d83
SHA512 02e7ea0bd871a7027789705e87c8efb33e62d7c0a753fcbb36901055da6a5484c959c1088f09fc72b676d5b3d8708f54927887b0d5428b908438347e62fa0acb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\19.png

MD5 bd6599d67d7aae03745573295805d54c
SHA1 b4a4bea98cd3656dc0e514ce43d3a841d52ccf99
SHA256 f4a44b81ba285b9bf78177235a2da976ae08f77cf1a00db5056c4d9527ed1654
SHA512 e57a9cac9e56752b85ee027f1d1281b6449c05e7d0f6a8bae864ac4d4457cffa50c93d0a4d67fd299e82de233370248b694508324eb3b33e1c20078531d798d6

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\22.png

MD5 324af2ae15c07f6fe72128746eef77a4
SHA1 db4c6b11d9827460534bb3f1e0ee8ea5fb795e67
SHA256 8eacbc263ab688c4cd7e5634dba3841e2dce088ed852b4d6b8ce2964cfc42ffa
SHA512 07877a44aa85b62dde6efbc416d1299395b4c5a5671e4aafb64479e8be9edc77b8bd540edfe8dee0df3a234886b3b24ed279e567d9cc2ab48e3092f56b003fcb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\30.png

MD5 a1e2b262c82afe1d3b44f99b2436672d
SHA1 a98825f116ea25279c2eee1e58ab73b2381dc124
SHA256 b6fc22e23ab61f0fc7f769159e7185e79a7b81de58791aa3c0a50bb329669b81
SHA512 366ed818776edf735c3d741aab2a99d0bc55bd21c7ae67b833585e5466b32f6815c30732a6b71d1e69f6572339fd61bad4cac752d3e6a387716c5668db100897

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\3.png

MD5 978fc278fd109f206df39545070e1da4
SHA1 eb8b44af471e6a9dd51af8db3c23275047eccb49
SHA256 e316295634d5c257f3951e9857298f5edf46f0896d312efb0f2976f80462408b
SHA512 c1a638c21d56df6dcdad73458574cb5f36cbd4527dd8ae7c578d4ac1cf230ec3813567ce1c687376879afc2b5fe05ed980a57f62ff9d3da5431b3c749d93dd39

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\29.png

MD5 8211a20bc3e718bac4e698b904462a29
SHA1 81ea116cad8c6c184c1b6448f96fd833be3a3ab8
SHA256 9016758ee07d8226eba9a02a0aad406340f4da9b5ba959877c31be9f1a00b71f
SHA512 cc1576cf64cd51f2338577a4ac9d75df0220ceb0ea68b43f5919fd777b42a41cc7ea0e6c600901cd5d3855d7778a0f05b6a63862a7ab5228b62063b3728d9114

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\28.png

MD5 36b3450114046bf6c5f112c5575611b8
SHA1 96c8e585168abe70f9d0c4cd7fece5814576d29d
SHA256 07b1006523dda31b363ec92cb55060eb60c9456feff47af8cc5eef03e707ef36
SHA512 1c7c4ab04ccfe4858d05f7cf9b92d62ac5b813c146e6e43e17a7a7c8be7fdcab23b839d36c58004d6fbad3309b94a9a410ea1a43cad375cafeadeaee273daf51

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\27.png

MD5 06f5440baf2cc1e8eb35e8406022a0e2
SHA1 dcec954a2bdd0cbbe1455e93de9724aaa47d2a70
SHA256 2ed3f1cbfa0713535232d5fe4db184422ad85c1fb4dedf4706bf6d805f39c392
SHA512 b8819a1428195cb2c8fce591cdedd0e5a8053a841eda631eca0024ddb6cf4faeedb7dc1dc3eb5138edecb196a8fa775b1cd764a5d617d436dfcc7f4c6d7aac61

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\26.png

MD5 f93dabb0aa9e388801e8aad37b434156
SHA1 7bd3139289228e747ed79c12ca627cc2413c757e
SHA256 8bd3c3da42c489050c1cc1bc0ba57c31f42b4aba7b6dda6956cdd1291d3b22b5
SHA512 3eaf82c9aa291de8275152327b85193887b4a2f4153d2b1ce60c7e35b2b45deefe4a36c076ad55ed0a55777bfb9681b58d799ac278562663e63e93051691f6f7

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\25.png

MD5 064cbce4288afa79b6117b0af5af5542
SHA1 a271ea70d00d8b94f5c1767765e269459ff323dd
SHA256 2570ffdc53f990b58c2201359b670faf6690fdde791bb14704a5cde626cc25cc
SHA512 96d9c5673ab5dbac49fcbd52ec11d69ab96fa10e5605c9aaa06b2e17ba966f2bccf267715b4108405db18aac0c1d2749f186d5951d64096b29b157ea1a7b658c

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\24.png

MD5 f1d1de3e0af5518455611c0d12c991f3
SHA1 535f1724af25fc418cf8b669e37cf947679b9f64
SHA256 b003214deae689804bb7726e753faf69ae228b092ca41cf5f35bf689c5b2f3b5
SHA512 f9460a68bf9ab8be55dbbc75d8679fc175e10c9d13e28946f0974709feb404255bf93e4ea8c04210bdc7c9b0315f92a84587cb05c195940b21f1f0ab6c5c0220

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\32.png

MD5 48b1f2923d9ae1224ecfc18eb48e43c1
SHA1 8bd130bebc33c631db59ce3a8c13863aa5690cb8
SHA256 456678114d2cdda5c2447dd5c197b4564c7f8b64062b188e1499d244f87696e2
SHA512 1e745c770710b4b4e8224a7128b9406c75d52b6569a908231807275f0760e47a90e9cac8bc65f09308080a316a4574e71ee91fdc8ed3592b8135cba38f064831

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\31.png

MD5 ce1b4b1d8f093a878e98d3d53d8e8669
SHA1 43737402da2d90a012b4b1ff36b6dd8c4f731cae
SHA256 3240b8cb461571587263e94f0160a2c4e614c1f0277e30dfffffdd3f19eeb165
SHA512 455601e6eb9d84ffb8f8a67cc65e81c62af46f09a15417e642dc9b4c5ca8abe6f1e702775c9b8ee7a16071825f9805c84ae7956de609ee12c1046bb126d2e94c

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\23.png

MD5 5b7a82da60e67587c6e1d354678529c1
SHA1 18e18287df6183fe39401ccbaca3f1b66b7bcc5c
SHA256 71113107a2f0d621d90f5cf71874c0ec530589976431d25a5bd6cf5b15432bb2
SHA512 aa42fcd71813d2c2b50f7f1f6af3ce80fbe8708f5572537aa2ca752512ad5c2ef28078b69f36ca75de3b185378530f1a69686538dd0318c9fcc537625eab6554

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\36.png

MD5 1700c9038e056584b4130157898410f6
SHA1 b7e760682011fd2ca2a31347b8c717f1fe0ef6bd
SHA256 57e37823c61cbb3ae2ec50881a0b794cd8cd3131d5bc00615f77632e3ddb4561
SHA512 c2d6074463baee1eaed1d87c25d947bddee58117e9f5e5803339dbf4e6ba933cd16738caa82ad701647275898d2862b9cd00dffce3099f04aeb156a5286fcd5a

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\35.png

MD5 cbd86f478b98d7a7184a36abaefa2946
SHA1 75a3afddeaed03ceff45c3e2a36faa8b2ad1074e
SHA256 b3097eff403a19aafc9479e6bb00a994b85d21aabbf6343b198dc402e82f3f84
SHA512 9309ce1801466e83d6b25c59d91e841dd19b115c5bd698fabf80242b62fbbc03ce97e31be3d303b82bdacee6c2b5eebfc9688ba22f9bc2d7d25151611d48dc1c

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\34.png

MD5 d2e7cfee7697c162fb45367b748b9527
SHA1 581497d6322fbcb25e52cbc95968a99a3df7b4e1
SHA256 d48413a31ea43ada1f905bc662ef715c44f6fc356e3f341372b0e8c5525face7
SHA512 6bf4b5791d79aaed9a1997817a639e2c8ad3c1323a7fd385a00c872645e9e44053627dff40956ac8c7cb27fbfdb1c5d972a2627c871eb3aa7461fc4cd40b8c2b

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\37.png

MD5 9c2dc70b8fcad1dbca19ea157ab66f9b
SHA1 a0d8611489e4e134c3d1eaafde3a74b5e819b25f
SHA256 dbf69058676bd3e4f73bbfe3210431e735dffa8846217fb8d1de1077266bde2f
SHA512 9e6c3b8b1b30ae2c12caa81066979c8147d84c27c5c442b236dd84ccddf4f6ed7386d41b2d42ea939bb81d069aef23bc8e54c1328edc25c5b69d8801c7f7b841

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\39.png

MD5 0509f4378a2f32bdc329900dd3c1971b
SHA1 72c7d9829c949a8f7322dced8081821bae37ab2a
SHA256 34a7b8728a668cf01f85416e9ab4c790dfb087a3f935a38c7bf81e045918ddc9
SHA512 124f2dd142221f78abb530a9a649c204fac74d07ebe4798ad16ecb6c5048d023c0f5c3c1bfa3fe08bc1019f0b4af566ca40b0c8ec3ba2dbff2dea2725f73f2fe

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\38.png

MD5 97a2bf7d57e5e173e417adbc70e487b9
SHA1 46c27e280e27b5080f3e555e53e7ef5ccd3b71b0
SHA256 5cdb249ee0d01596bd4c634dff1353282bbc91768c77706b77079e9e811220b6
SHA512 58c9dc590e38325f5c05e3e4adaeea9873e2e734a1c49c7c66977e65352e31038994c0bed439f43d14ceefed0f6b84aa1d35fb638dba6897cb0de0d2cf6c76d2

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\33.png

MD5 9bd06d03be71ffa54de8f7d3938108b3
SHA1 cbc432d5821883045d5c72677a01951e4090a7e0
SHA256 b3a29ab1bdcb1a8e027a92d5ede843485553c7554f6eb4ae832e38041f0880b0
SHA512 2cfd2ad71c3e51a6d3d50098a56db36279dabe17cb98921b2a891e4aaca2cb0413ff3513e4cd6803107e9b422fcbc67ae86b0b8148dcaf262a124a7301c488e7

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\4.png

MD5 0d44c34c20571042f203ea253ea4d55c
SHA1 333cc13952391b4acb96b9191ea59f3fc1e521da
SHA256 27b09323f37b7877b02df789b938bd792e0a5504de9cd405c76276b19c41f60b
SHA512 1bb144dc607831bfaed82981c73b09be655448349425b89c608792b8a5ee43a7653efb2ad75afc2539093903b03916ae7bff019dc9e10a9d747942b9e97127e4

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\40.png

MD5 29dac7dba26b3f49231e9d38d28ce84c
SHA1 0ef797529ce2b97a0d366333cd891812f7584709
SHA256 46a41b720beb99aba5643675c42a3882dabad5e8d7199de37b1ab2360db3d0b1
SHA512 b01478523f89b5f006a562e93f48a8b64e18d256c48dfc2c26cc89ed6cfb33ddb742a4d34683b88684b79fe88dca7d3583023b71dbb2909445af94b5b52211c8

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\41.png

MD5 53cfb99b1b1ce106ba18051e28b5fb8b
SHA1 9717abeda7046973b6162ea5593e2c71d45d5cf7
SHA256 d0106f503486aea379cec27d4df6b84f26e1cb312613e2762421a428e85c3ed1
SHA512 24b2e8f766c3a4fa7c4cfb47882acdff6c59eac349834cc9302ff0bf5475f568591f81dd3f6d8df93a4d9eec6c556ca74c9bfe9f3f233b1e413bf70dca0cf3c1

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\7.png

MD5 97c3ad3885d6c0c0174510788ec85e42
SHA1 e4ce36da271ef8028aa6b85c857536c2bccd16cb
SHA256 162b3b8729418a3925447d50b4fbb24482c82804ffa7a46eaf82b751eac10899
SHA512 3f800c998e82375fdc0f75da6f91d4175170713b4d19d43711cdacee0490e6fdf4accdbed568e75228b6c5fd443da5a93a59e8c202a5ffab09f82e2d1aab2e55

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\8.png

MD5 4b3f9cdeba108423f3c80300efff1958
SHA1 ef7fa256ae3441a568c8f3bdf4ee5725f732af89
SHA256 6239a97e39e6604584d5d3aa05075a00ea277371b7af79e14536ae79edfa93fd
SHA512 5deb2c296d6d111543461f4d4a95db0201af3f6660194dc9ae13cd6964339bd570ac99c99d9f7f4e04bc1ec6ebc51b6adc51db92ebd63a32108811c29f3adfff

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\6.png

MD5 f35ca234c01575ae87bd0308823ed62a
SHA1 d06f45f05291cfaadb34d537f453bc0f01ad38df
SHA256 18242f17950a2df4a55cf8f19c4e0d38125f6a8a565552b8bb786a2470ede112
SHA512 7c3ffa3951c799d9ad4e494d857530381da7af700711c259bdd8bed877c2e926e9100e9c0ad36ca9b67986c5956f7394369fcba461fab3badf4eebe55f5272d5

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\5.png

MD5 baf3a84232614cd8c2ee9133296f7234
SHA1 43faa2409b5eef379084c9ebd620fce00f0bb6b9
SHA256 e46f2319d3988173c1766d9ac19dadc3bf63fb98432b7c9636241ae5c356a319
SHA512 e8c0bdcb049ec3ead84a1215b34dae0512358ad85702f31ce7618712d8f4d9afc86eb823b20090db5354463eaa6c1225cd4f1fd95ed1b7e11765bbd22b798575

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winhelp\usermanual\css\dynatree\vista\9.png

MD5 c1a44e8bce9ed3d25e95b6f15f08721e
SHA1 bed5e6825dbaaddbbcffa255d67693ef0961b724
SHA256 a1590194311c386a5c8659c0b763a7ee45cab9639b526d2a822776035317ee02
SHA512 75a5293db695c242b25334b17e9653ff1a5f73f68238217d808596ed09df9f122853dd48cd39b2a0e4ec98487ab55ac1049b3c913e31887fed7c1660083bf4bb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\xxcleanup.txt

MD5 04a9c9258e3ca67142c2190e0b457978
SHA1 05c84cff023fd37c880b60d573530560b3ba9ca7
SHA256 95b1ca34006643256ce7c2a259829fc6f65947251844614b690957b5307f6719
SHA512 d158358ed74069b4aba29729086f729b982c2d7365ec7d8a7f76b14113671b6fc6783a90845b11bf312863c881df4e6aaaef403680cb729912bd1a8d675051c1

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\x86_64-efi\crypto.lst

MD5 6a3f58db454b17a0a339323b3e134a6b
SHA1 ff00d28114398cf1a052329494d63aceeb8ff29a
SHA256 1b766f38a94927fe9b7bc1e809f0363e778e14c601e800faea271a2e75d3fc43
SHA512 7488c4b6c106c8658a308e514b6fd03e6642f201737fd2716831733d98c3d686beab9903d36b0b2e9e30b3c01f2bd9757f30605d318215878a2b932ec4ab5ebb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\x86_64-efi\fs.lst

MD5 4f72bc2bcabe379b4fe0f7e1bbd03c04
SHA1 f091655c7ac7314eb0df21931415de47628d621f
SHA256 32fc7f5de8c0a5dc0b1e7eb609ca31a77eb3475539e1d97a4543dca1b9b26c57
SHA512 930e8cd4d3e74f6fe9f7a66b93abb846624f1eecfddff45f943dd20e86da06ac55dc3f4226a2b2de15285746365d6fa8112737bd2d75a364a28fc38a28a6f552

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\x86_64-efi\parttool.lst

MD5 3190a91d3075032543740d0998971d77
SHA1 408f07c267ffdb9554b69138616a472fe4207026
SHA256 6de6036ef0dc8a908e4cc248ef1d8aab87172e722d8c5bad9e137fd43994e0fe
SHA512 6fcbf3a8135d075bd23f0737a8d50327f2fd585738b5439968d0c0448b9e19ac74cfecaf483bf323433effe2c460e563ffc0e5a6aedd7f2bf8a30ea4b52bf038

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\x86_64-efi\partmap.lst

MD5 02b988d7196362ddf27caaecf35c23dc
SHA1 b5a777a9c9d1d484b9f133987047bca324a9c01e
SHA256 85a3d5f84d20723a27c1442b861be44fbf58a4525eefe2ccbb2b5f7ceb21e8be
SHA512 4efa28eb28d06d4fdc7de8086910588359f7013a47f199a8e6af037fdcfcaeb535124417cdafb8d1d417aa9a09123a59525a6bdefddc5d1939aada231e606e91

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\x86_64-efi\x86_64-efi\core.efi

MD5 2f117cf85668e3cb77ddc79486378a48
SHA1 841a1e185de4cfc8ae6991e8f27a0b1dc9a0e9db
SHA256 34a3088e15d5acff1a25bec07109b18d17f2fe6b07ca1cccb261234ecccb0fcc
SHA512 75c6d7196ca89a51d0d9298b0d77c7e1fcfd062d10085a187bf6c7d08c93481e3bb93be51d3a4ba8487cda8a56060200448fab2f057536fd202de64ce5f99e3d

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\x86_64-efi\x86_64-efi\terminal.lst

MD5 098832497928edecd396096490b430de
SHA1 66b726c6d64bc109d3948a9528f502ea94938ef4
SHA256 46f888c52f36baf9b62d60bc8d06426a314aad5a0ff86a4362a91c2512a1df9c
SHA512 4fdd3b4cb38c5c69865033bca010d6b914ddfb74dcc5886b258fe4fa8759a1160ec4b924a1c7a7128b0f6899e6f3b0e33373a1ee7532e533e9b6b1629e52533f

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055358\inet.work.internet.txt

MD5 aa43a7da2ac1c4c3a62c134ba0ec03b2
SHA1 a4c2aa7a312975ad468d60285298af9438881e65
SHA256 d2d632846dd5563a25b13783888448fc93016baaca3871cdeb1ecb1e28d5ebcb
SHA512 d1480b9e35c9d8e0c6941654f0a3845cb2ddabd99f2e5dec2bcd9152cd7a0ed9b69cd57fe6c395ed7b085efb0fca7ea4f9e1bb3b706dd17c31ea8a908d0476d9

\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055358\install\winsource\grub2win.exe

MD5 2888f530d3e01fc2901e3183aa81d308
SHA1 f77b10eb25fe53d02919757ac5caffda426b22be
SHA256 922ccb25b4ac7693487181af29d3bafbdff71ac318348eebdf32ee3d94f030f9
SHA512 0ea55e2f6777a302c934f622209a51cb2bbe82c8d0642a56078438f4b3212d21e5b05d4d3d23e93869a4581096b8091551651c97f34d65ef687cad0867f31836

memory/376-3384-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/2884-3387-0x00000000008B0000-0x0000000000BCD000-memory.dmp

memory/2884-3381-0x00000000067F0000-0x0000000006A0B000-memory.dmp

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt

MD5 b79fbd6daf1b05c5fe132a183e242504
SHA1 cf37299bd587ff61010f0d9e83566f11ac9bc624
SHA256 1cb5d9d78ca0e30c9e4b6cb0a5838d927792a54b9930308e604dfd9a9a43fe8b
SHA512 0dcd359619806b54398c123d903556660de510bf20372eef69835c96560644b14abc5d7f5ede638866068a462a704ce1d04aa19e6a3240d6dfa815607ef184e9

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.output.txt

MD5 cfc0ea14250a9e68ecae324bd1eeaa31
SHA1 ebe70e58a9f48adaafdb4971d1bed9c50e09e705
SHA256 1224c17bb26cb1269020c26eba255ae4f0f2e7c2b36cf5b7aff7dc9e8e2e1cde
SHA512 bdd299d4d8e59a354385b1ddf5083e1fa3cb01831b977e9505925e60eecd6f0f5c885f4a82a4ed94a647f8706f1ace201733c1d61391096c08866d86bf8ff98f

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.script.txt

MD5 e8927b03efcd1ea1b567f9d8335bd927
SHA1 1f5f208fe823c728da04bbd4440b520bf0fb45c6
SHA256 f966e7559ea2a95e7c6d2f7827f36f478362bb736e0502754b0ecf1954c75040
SHA512 9b2b7c08f2496a2dcb84eb527bcce90ef0112250abbb9b7282278bbd68e960274ce642b6c50464e4f43fd7ddf12fbfc88d712533dcc2e582a5ee3e5fbb98adc5

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.output.txt

MD5 5bf4f84ed776a5b8614b7242e4efda60
SHA1 270d10ddb0485ea267afc7aee2435422e207ffff
SHA256 914c9b39c7b49b8c557b4072a039ec718eee43307dea2bf8400c71192e737111
SHA512 de782c972ea8078119a082fb75624fe803910379410a83c319a080a1b9a59be5bb7995518c6ed23b6a30b0c3e27cae9b829ed6f087f2c213d188fd1d9a70188a

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.security.output.txt

MD5 c5f391be9e8bdc0ab1a4ba2c80b7cbf1
SHA1 7407d8ca672be8194f74e8c734a64ffdbabdd57e
SHA256 059f065dbf5cbf605c78de731a91db5a5229b41a0bbce1e50048ee0983850545
SHA512 6bcf978b6ee1bc199b9749d0296e0d5966b383beda1fac6a9d63442e85cba0aa69b99dda190a090044d3bfaae7e6f030eb80ead60c3beb28b983e9a34f4ed361

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.security.output.txt

MD5 04d134900b0b9c7c72b5942a7afc151f
SHA1 624e50d0a2143fffe0ec5fab0735906a30ae5514
SHA256 01d225329f3e5d6a35a5c5890e7a715ef6d2950434dc16038a23ee6cf9e4730a
SHA512 70196e89e85ca2e76c2de799c36fb3527b32b1b4065ab22e33bc3816e60d72d574aee34bb4e1f9d1f797c654fd684bcfa117d61f0b3d67b1fc1017a38ac87eb9

memory/376-3411-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3412-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3413-0x00000000010E0000-0x00000000012FB000-memory.dmp

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\direct.diskpart.output.txt

MD5 45257ae69f928eb46ddbee5d617951b9
SHA1 3b1be9dcce1ddd0c061a8f16391312aa253fd223
SHA256 197008f3426d9dfb968826368c89677e8439ed77a321bd5569a487681103126e
SHA512 5cc60a5c611b85a1b33049c66a2dea0e61dfec7d7d0a4ebabba9030c31014bcc9de7f1495c37120bfb95e2b4cc6e5818154a1658de9529e0bf0957ffe99db399

C:\ProgramData\Grub2Win\grub2win.exe.24061820061981\encryption.status.txt

MD5 a9463a139bffc11fb75e8edb6e763707
SHA1 ea9439da6cc5e0b010df6c03f8be62167651659a
SHA256 3aa5814cb5e2788219b3b42d2ac30d17e32b93d49c9d139f1c3d0aca38fad05c
SHA512 946c552d5f8d9e2e9f6b09b73328683402f133b81d74fae85463e63f63e2a3f5243b33d821c9ad9ad904bbb6cb1ca5b502c229647b795298a6f775b77f2001f4

memory/376-3420-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3421-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3422-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3423-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3424-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3425-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3426-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3427-0x00000000010E0000-0x00000000012FB000-memory.dmp

memory/376-3428-0x00000000010E0000-0x00000000012FB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 20:05

Reported

2024-06-18 20:08

Platform

win10v2004-20240611-en

Max time kernel

142s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe"

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\z: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\o: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\q: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\r: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\v: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\x: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\d: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\f: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\w: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\M: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\i: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\p: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\s: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\u: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\a: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\j: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\y: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\g: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\m: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\e: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\takeown.exe N/A
File opened (read-only) \??\n: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\b: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\h: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\k: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\l: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened (read-only) \??\t: C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\EJEFCDNK\root\cimv2 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\EJEFCDNK\root\cimv2 C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime N/A
Token: 35 N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime N/A
Token: SeSecurityPrivilege N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime N/A
Token: SeSecurityPrivilege N/A C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A
N/A N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4736 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime
PID 4736 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime
PID 4736 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime
PID 4736 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe
PID 4736 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe
PID 4736 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe
PID 2596 wrote to memory of 4868 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 4868 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 4868 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 4868 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 4868 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 4868 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 2596 wrote to memory of 3796 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 3796 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 3796 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 3796 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 3796 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 3796 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 2596 wrote to memory of 3896 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 3896 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 3896 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 3896 wrote to memory of 988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3896 wrote to memory of 988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3896 wrote to memory of 988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2596 wrote to memory of 552 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 552 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 552 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 4524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 552 wrote to memory of 4524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 552 wrote to memory of 4524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2596 wrote to memory of 1248 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 1248 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 1248 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1248 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 1248 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\diskpart.exe
PID 2596 wrote to memory of 4760 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 4760 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 4760 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 3720 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 4760 wrote to memory of 3720 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 2596 wrote to memory of 4480 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 4480 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 4480 N/A C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 4040 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe
PID 4480 wrote to memory of 4040 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\system32\manage-bde.exe

Processes

C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe

"C:\Users\Admin\AppData\Local\Temp\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe"

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime x "C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Download\grubinst" -aoa -o"C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456"

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe Setup "CleanupDir=C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt > C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.output.txt

C:\Windows\SysWOW64\diskpart.exe

diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt > C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.output.txt

C:\Windows\SysWOW64\diskpart.exe

diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c takeown /A /F M:\bootmgr > C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.security.output.txt

C:\Windows\SysWOW64\takeown.exe

takeown /A /F M:\bootmgr

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c icacls M:\bootmgr /grant *S-1-5-32-544:(F) > C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.security.output.txt

C:\Windows\SysWOW64\icacls.exe

icacls M:\bootmgr /grant *S-1-5-32-544:(F)

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt > C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.output.txt

C:\Windows\SysWOW64\diskpart.exe

diskpart /s C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c C:\windows\sysnative\manage-bde.exe -status C: > C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\encryption.status.txt

C:\windows\system32\manage-bde.exe

C:\windows\sysnative\manage-bde.exe -status C:

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c C:\windows\sysnative\manage-bde.exe -status C: > C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\encryption.status.txt

C:\windows\system32\manage-bde.exe

C:\windows\sysnative\manage-bde.exe -status C:

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 sourceforge.net udp
US 172.64.150.145:443 sourceforge.net tcp
US 8.8.8.8:53 145.150.64.172.in-addr.arpa udp
US 8.8.8.8:53 downloads.sourceforge.net udp
US 204.68.111.105:443 downloads.sourceforge.net tcp
US 8.8.8.8:53 105.111.68.204.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 netcologne.dl.sourceforge.net udp
DE 78.35.24.122:443 netcologne.dl.sourceforge.net tcp
US 8.8.8.8:53 122.24.35.78.in-addr.arpa udp
US 8.8.8.8:53 0.pool.ntp.org udp
US 8.8.8.8:53 231.132.5.213.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp

Files

memory/4736-0-0x0000000000070000-0x000000000038D000-memory.dmp

memory/4736-11-0x0000000000070000-0x000000000038D000-memory.dmp

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Zip\zip7za.runtime

MD5 9fa07f7b0ffee060b7ed69f0e028b03f
SHA1 24d4301baad23ea6b35004e63a93bfa6e71b473d
SHA256 bb6b9f15ff2fc1b938693be31965d50c23bd79244c013f0223f2e39fe08944ce
SHA512 aadba7515c0d12fb6be584601806037105a17d556968d9493387c2868d9e33e008a02417db1e1b89e66362d94957d6f40bd139f6305d5b01461e94ff99d835c8

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\Download\grubinst

MD5 e93162cd949b8791d2fb81751972dfa2
SHA1 9e4f02cb6dfa9851cf36b28c43457281159ecd49
SHA256 3f86fa99a20c2f5cb5751ac046bc93aeb9037d1df4cb804b30a58306664d8625
SHA512 3bd1ad31a46d91c3543816ce0e66d402ee1120d6aa0ac43c3e2368be84c5df9a95f68ae918f12762ba4cfe22d5f643844471667a0b71fc26ce5f9f8cce5ebe7f

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\locale\hu.mo

MD5 40242c1cb16f3ca91dbc278522391412
SHA1 8ff6e98dee6f239a14eb725bcfd1c97ba556bc57
SHA256 9033a4326ed2ef8923e47b87f74996f8677ec848507fe1aa4d82df0238afb2d9
SHA512 89247fe240d06871510465c0dbfa8c8af29e2198557af6693bcccaf3d0c54487745dcea4e73d63afa7ffeb17ca8aa8c1ce6d9f1f29558087756272ad22c9ccd9

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\locale\ko.mo

MD5 04a03fc01898738cf312c1921f7c1b83
SHA1 5f8db136a0ac9a51c2f2da83a17f53a4c784a089
SHA256 9462dd84639686e1596075b4aa6dd30539b0e60668c786e3441084bb75b57417
SHA512 f27cb7c99ea994abd3a5f76f0017e51230aae97f5cb04be3aa6b7d65d509a54a23ff30521342ca18c03984271172acc69820fe2f9ae0c86042109316b36a9aec

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\themes\common\colorsource\radian.png

MD5 54fd7851317f76824702f27ce73aebaf
SHA1 dcaedcabe71b23b816d5f1761f9c4a8eec5f5588
SHA256 ef789f0038029b55141e1c89a9879f3ec8621f3e416c32847972dc0d30a31234
SHA512 6f5841f0cb9346a86a53fef0b6151ba113733920c2ea044b10f9940e82de2eb2af7975aca4593a84069b6bcc58b1224c653b0e74acb045b2fc64a096cd87018e

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\themes\common\colorsource\snowflake.png

MD5 2928e41c326b8e24942885db0bcce0d8
SHA1 07f3dae39eb94a351d7b2fc9291ffd6808807228
SHA256 9c3b8372be727a32f864eecab9fe78da10be50b62a2f59e1c333ca01c649ff0c
SHA512 e1a4f2562d2fa2e5c20dd6e847e1bdd10b4279f01653bab1b438c89b7b08ecbb733097b3439e299aeaa4efaae90c2563b14a9c69ab31961899b8313f9c483656

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\0.png

MD5 0df2a89e2fc183745a4a933573ca3661
SHA1 6d6a1d28a1464a0df5f6b4f98dc3ce6309d080f4
SHA256 e28fd0c48b9bc579ed66b23efc92e7b071592c8a93ac281bd35e0ada195b3ec6
SHA512 cf9a57a8718643acd13c4e52fd381f1a06d6fca6de8869bffc711596d3a09ba4aa8e555aec5070718286a617fdd32910a711b29d575229b793430194e1752322

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\1.png

MD5 51d00dd365a4e751f03137ff4650246f
SHA1 bec678099aa192ddf29b44a26a48ee744065461d
SHA256 bf166874102c79b51a753814607a6c61ca84b1a481fcda4cbb0f11b2313bab8c
SHA512 edba25e081f4e5ea7efd2a811e5ad1120c2360f6f29ed37477b62599160e2553e8a71ed07a651895aed8e5dafbf0d79b7c2503bb8e8cb4aea6aab1436810081a

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\10.png

MD5 97c1005c5222ea8768c0eaa0eaef0720
SHA1 0b49ae47e365b169ea36701122a77bbd1ebe57d8
SHA256 3f1133fed577fa5b6a30cb3a33b54971dcb385f50576f15a75608530cc80fe2a
SHA512 81ff262ee8fa50d03ce07f80eff61ba01ff075cd868c0c3b96749f53f1187f9463bb65a42b6b496aa5cbd68a77fcb255fbdf4946a50fe1bc40ff44ab3630ac59

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\11.png

MD5 6fbab54dc0a4998230f8bc5d171d3cf9
SHA1 dd3a235951366dc3c6e718221f3a0e8b9f6abb4e
SHA256 8d49d2d6e46def8f9ab8ade45c0dd3d53d84bb5fca51a278fee24230374d0c83
SHA512 de0b3666c8431d541f881f362cc54b00650311db0489c8dd4f37eea27409434ce537d2b634a045bd4bc758e55abcf76154aac03c4acd417bee45a2198f29c3e3

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\13.png

MD5 f7c5136334675cbbbf472d88edd07c86
SHA1 ee3db81b274c256859f69491a1d7c584c91bbe75
SHA256 82dfa3fa3234d0224a20b0481e6fa718f10baad5d0e028e50efcbdc9757f47f1
SHA512 62e2329a4f4c91865aa6386da8f9a53883163c577132b1cde2c86d01e4fa7ad6349bfb74902899ba848945f4e48cfe1d0983b1fb0b527b978b20501108b23906

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\12.png

MD5 d976126624684569de1b9eebce279211
SHA1 7eaccaabccf9a055d89154f04d4f21506d680381
SHA256 330538eb0cbf8dabd56a19c770a08e69027dcb3129c11f719f2c0dd7bcc7dcb0
SHA512 6a351ab2c0e1cd9eb4a6089a4a9137e005299c850f1d5fe269fa52290a51d866be1f3c289c2b1bb3bfb291c2c307bf711d7307b4bb73ce7c96ae3844444ae259

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\14.png

MD5 def267fe65d7d4ab8b1ecb39439ccefa
SHA1 a53aa17c48ed31f71a8ce84798a37b1bcab7f5f8
SHA256 5f2468ea24844d0b4333c3a007c3097b92bc46a3bb03fbc50d00e857447769c7
SHA512 ee45aa47713059c00505e39c1cf92a0a893493ec4140dd6017c23f01342acd006d5639e48a4d059e66469a73f861db2e776ebfecf02f12e3d45649e0d9be3ae6

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\15.png

MD5 8d1bc59edbf35e178a0d8d466a7c5aba
SHA1 6f109d15848e844b2ed15f224304c4adf5eb705c
SHA256 bb62b6c1f983b342e98111e205a303411f24447cdb5827678c722280718cdce7
SHA512 68315d3ba79a912989a7eda7024b99c8c79be85527cb3ac6b240fd0d2d9596f2b2994fe6ef8a091ee50db932385f9d969cfb4d7e3c735760e0f7099796bb62a4

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\16.png

MD5 6dfa8f6b212ddccd03860ca89a69e067
SHA1 34adef80aee89e3f81ebfa404d57c3822ebb6af3
SHA256 7f37a12ba62689af22d2866f8907f475d93a6798572dac54ba2538d12f4c8903
SHA512 c05bb2028bd2e9fbf0f1d66739cfd582a89afcd24feaa348c94e684e8bdf22c2b8b82dd4d978bd1294ab4a4611ce7d3ffc90b02ad92c08962fe0fe9c0949a9e5

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\2.png

MD5 6441bc777463e9737e5ffea8bf6aba70
SHA1 79eb3d2e439715dabcbc75873bcbd827ab4a49e2
SHA256 83b0515460d543934aecc85adcbc54f75bde0f16599ea6d279e2015608259d83
SHA512 02e7ea0bd871a7027789705e87c8efb33e62d7c0a753fcbb36901055da6a5484c959c1088f09fc72b676d5b3d8708f54927887b0d5428b908438347e62fa0acb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\19.png

MD5 bd6599d67d7aae03745573295805d54c
SHA1 b4a4bea98cd3656dc0e514ce43d3a841d52ccf99
SHA256 f4a44b81ba285b9bf78177235a2da976ae08f77cf1a00db5056c4d9527ed1654
SHA512 e57a9cac9e56752b85ee027f1d1281b6449c05e7d0f6a8bae864ac4d4457cffa50c93d0a4d67fd299e82de233370248b694508324eb3b33e1c20078531d798d6

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\18.png

MD5 4e4609a5f6c060b25ddf8565b5169897
SHA1 c23b1245847b482d413dd80dbfdafd922f23db86
SHA256 230a24f9a6d714793ea2e35dc73bef51e66ceb40a497d226f877dcac5452dede
SHA512 4123883051aa00e8a7ec249a3e13e6b9e87b6492affea479048c6fc5c089893778a850eb107c79c62a18b2a72b44ef91db22780b2e89079bd7798f6476a7f346

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\17.png

MD5 0351799a21ce9d3968b384f095b7d5c8
SHA1 16062b17a05c27a1c29b44394d1360f25ab6b819
SHA256 11d654eb2b8788200c12a4fbf175534fcb3eb6bdc892f68f015e15083a193c17
SHA512 65f045efcac50b90803902c6bed6bd5be6957a7b5c5dddc591850f71e62c2caed24be119e5623ccd711f587949b0cea21c56c42ecac8ef3ed903a7522a0377c6

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\23.png

MD5 5b7a82da60e67587c6e1d354678529c1
SHA1 18e18287df6183fe39401ccbaca3f1b66b7bcc5c
SHA256 71113107a2f0d621d90f5cf71874c0ec530589976431d25a5bd6cf5b15432bb2
SHA512 aa42fcd71813d2c2b50f7f1f6af3ce80fbe8708f5572537aa2ca752512ad5c2ef28078b69f36ca75de3b185378530f1a69686538dd0318c9fcc537625eab6554

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\22.png

MD5 324af2ae15c07f6fe72128746eef77a4
SHA1 db4c6b11d9827460534bb3f1e0ee8ea5fb795e67
SHA256 8eacbc263ab688c4cd7e5634dba3841e2dce088ed852b4d6b8ce2964cfc42ffa
SHA512 07877a44aa85b62dde6efbc416d1299395b4c5a5671e4aafb64479e8be9edc77b8bd540edfe8dee0df3a234886b3b24ed279e567d9cc2ab48e3092f56b003fcb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\24.png

MD5 f1d1de3e0af5518455611c0d12c991f3
SHA1 535f1724af25fc418cf8b669e37cf947679b9f64
SHA256 b003214deae689804bb7726e753faf69ae228b092ca41cf5f35bf689c5b2f3b5
SHA512 f9460a68bf9ab8be55dbbc75d8679fc175e10c9d13e28946f0974709feb404255bf93e4ea8c04210bdc7c9b0315f92a84587cb05c195940b21f1f0ab6c5c0220

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\21.png

MD5 9a30d58431abed7dbe48a416e1a459e6
SHA1 faa6a8d798b644e7aafc21bf94f29ff979197990
SHA256 6befbdee672fff55cd15bb65190463af0c4ebd41ab7f5591e7472d3d9b52c325
SHA512 bd2b0ae99af9caa60825c1a18c0533c831c7d8e113b6ea579485d03f6660b7e7553e5dcb4d4f129e7c367b3cf306525fc0e1ee4500ddb4b5fe01d8507d726ad1

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\20.png

MD5 2dcf566260bb90ed15cb9be9045bd6ff
SHA1 7a4429d54dceef8d91749aad21794031b1767c50
SHA256 caf95f64db3d13a991bcf1e0d65a9df60e8fafc21bc8a0d56404ac8ed5ce8374
SHA512 f345ff76e827a71a9ea306bcca311aca329453c652a9d6c09a0ed6f3a02fba0a22bb1db6ad5485bc52eae96e74e08b9090d8d82197a170bd3b0e32357fd1dc23

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\25.png

MD5 064cbce4288afa79b6117b0af5af5542
SHA1 a271ea70d00d8b94f5c1767765e269459ff323dd
SHA256 2570ffdc53f990b58c2201359b670faf6690fdde791bb14704a5cde626cc25cc
SHA512 96d9c5673ab5dbac49fcbd52ec11d69ab96fa10e5605c9aaa06b2e17ba966f2bccf267715b4108405db18aac0c1d2749f186d5951d64096b29b157ea1a7b658c

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\27.png

MD5 06f5440baf2cc1e8eb35e8406022a0e2
SHA1 dcec954a2bdd0cbbe1455e93de9724aaa47d2a70
SHA256 2ed3f1cbfa0713535232d5fe4db184422ad85c1fb4dedf4706bf6d805f39c392
SHA512 b8819a1428195cb2c8fce591cdedd0e5a8053a841eda631eca0024ddb6cf4faeedb7dc1dc3eb5138edecb196a8fa775b1cd764a5d617d436dfcc7f4c6d7aac61

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\26.png

MD5 f93dabb0aa9e388801e8aad37b434156
SHA1 7bd3139289228e747ed79c12ca627cc2413c757e
SHA256 8bd3c3da42c489050c1cc1bc0ba57c31f42b4aba7b6dda6956cdd1291d3b22b5
SHA512 3eaf82c9aa291de8275152327b85193887b4a2f4153d2b1ce60c7e35b2b45deefe4a36c076ad55ed0a55777bfb9681b58d799ac278562663e63e93051691f6f7

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\28.png

MD5 36b3450114046bf6c5f112c5575611b8
SHA1 96c8e585168abe70f9d0c4cd7fece5814576d29d
SHA256 07b1006523dda31b363ec92cb55060eb60c9456feff47af8cc5eef03e707ef36
SHA512 1c7c4ab04ccfe4858d05f7cf9b92d62ac5b813c146e6e43e17a7a7c8be7fdcab23b839d36c58004d6fbad3309b94a9a410ea1a43cad375cafeadeaee273daf51

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\29.png

MD5 8211a20bc3e718bac4e698b904462a29
SHA1 81ea116cad8c6c184c1b6448f96fd833be3a3ab8
SHA256 9016758ee07d8226eba9a02a0aad406340f4da9b5ba959877c31be9f1a00b71f
SHA512 cc1576cf64cd51f2338577a4ac9d75df0220ceb0ea68b43f5919fd777b42a41cc7ea0e6c600901cd5d3855d7778a0f05b6a63862a7ab5228b62063b3728d9114

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\3.png

MD5 978fc278fd109f206df39545070e1da4
SHA1 eb8b44af471e6a9dd51af8db3c23275047eccb49
SHA256 e316295634d5c257f3951e9857298f5edf46f0896d312efb0f2976f80462408b
SHA512 c1a638c21d56df6dcdad73458574cb5f36cbd4527dd8ae7c578d4ac1cf230ec3813567ce1c687376879afc2b5fe05ed980a57f62ff9d3da5431b3c749d93dd39

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\30.png

MD5 a1e2b262c82afe1d3b44f99b2436672d
SHA1 a98825f116ea25279c2eee1e58ab73b2381dc124
SHA256 b6fc22e23ab61f0fc7f769159e7185e79a7b81de58791aa3c0a50bb329669b81
SHA512 366ed818776edf735c3d741aab2a99d0bc55bd21c7ae67b833585e5466b32f6815c30732a6b71d1e69f6572339fd61bad4cac752d3e6a387716c5668db100897

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\31.png

MD5 ce1b4b1d8f093a878e98d3d53d8e8669
SHA1 43737402da2d90a012b4b1ff36b6dd8c4f731cae
SHA256 3240b8cb461571587263e94f0160a2c4e614c1f0277e30dfffffdd3f19eeb165
SHA512 455601e6eb9d84ffb8f8a67cc65e81c62af46f09a15417e642dc9b4c5ca8abe6f1e702775c9b8ee7a16071825f9805c84ae7956de609ee12c1046bb126d2e94c

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\38.png

MD5 97a2bf7d57e5e173e417adbc70e487b9
SHA1 46c27e280e27b5080f3e555e53e7ef5ccd3b71b0
SHA256 5cdb249ee0d01596bd4c634dff1353282bbc91768c77706b77079e9e811220b6
SHA512 58c9dc590e38325f5c05e3e4adaeea9873e2e734a1c49c7c66977e65352e31038994c0bed439f43d14ceefed0f6b84aa1d35fb638dba6897cb0de0d2cf6c76d2

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\39.png

MD5 0509f4378a2f32bdc329900dd3c1971b
SHA1 72c7d9829c949a8f7322dced8081821bae37ab2a
SHA256 34a7b8728a668cf01f85416e9ab4c790dfb087a3f935a38c7bf81e045918ddc9
SHA512 124f2dd142221f78abb530a9a649c204fac74d07ebe4798ad16ecb6c5048d023c0f5c3c1bfa3fe08bc1019f0b4af566ca40b0c8ec3ba2dbff2dea2725f73f2fe

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\37.png

MD5 9c2dc70b8fcad1dbca19ea157ab66f9b
SHA1 a0d8611489e4e134c3d1eaafde3a74b5e819b25f
SHA256 dbf69058676bd3e4f73bbfe3210431e735dffa8846217fb8d1de1077266bde2f
SHA512 9e6c3b8b1b30ae2c12caa81066979c8147d84c27c5c442b236dd84ccddf4f6ed7386d41b2d42ea939bb81d069aef23bc8e54c1328edc25c5b69d8801c7f7b841

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\36.png

MD5 1700c9038e056584b4130157898410f6
SHA1 b7e760682011fd2ca2a31347b8c717f1fe0ef6bd
SHA256 57e37823c61cbb3ae2ec50881a0b794cd8cd3131d5bc00615f77632e3ddb4561
SHA512 c2d6074463baee1eaed1d87c25d947bddee58117e9f5e5803339dbf4e6ba933cd16738caa82ad701647275898d2862b9cd00dffce3099f04aeb156a5286fcd5a

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\35.png

MD5 cbd86f478b98d7a7184a36abaefa2946
SHA1 75a3afddeaed03ceff45c3e2a36faa8b2ad1074e
SHA256 b3097eff403a19aafc9479e6bb00a994b85d21aabbf6343b198dc402e82f3f84
SHA512 9309ce1801466e83d6b25c59d91e841dd19b115c5bd698fabf80242b62fbbc03ce97e31be3d303b82bdacee6c2b5eebfc9688ba22f9bc2d7d25151611d48dc1c

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\34.png

MD5 d2e7cfee7697c162fb45367b748b9527
SHA1 581497d6322fbcb25e52cbc95968a99a3df7b4e1
SHA256 d48413a31ea43ada1f905bc662ef715c44f6fc356e3f341372b0e8c5525face7
SHA512 6bf4b5791d79aaed9a1997817a639e2c8ad3c1323a7fd385a00c872645e9e44053627dff40956ac8c7cb27fbfdb1c5d972a2627c871eb3aa7461fc4cd40b8c2b

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\33.png

MD5 9bd06d03be71ffa54de8f7d3938108b3
SHA1 cbc432d5821883045d5c72677a01951e4090a7e0
SHA256 b3a29ab1bdcb1a8e027a92d5ede843485553c7554f6eb4ae832e38041f0880b0
SHA512 2cfd2ad71c3e51a6d3d50098a56db36279dabe17cb98921b2a891e4aaca2cb0413ff3513e4cd6803107e9b422fcbc67ae86b0b8148dcaf262a124a7301c488e7

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\32.png

MD5 48b1f2923d9ae1224ecfc18eb48e43c1
SHA1 8bd130bebc33c631db59ce3a8c13863aa5690cb8
SHA256 456678114d2cdda5c2447dd5c197b4564c7f8b64062b188e1499d244f87696e2
SHA512 1e745c770710b4b4e8224a7128b9406c75d52b6569a908231807275f0760e47a90e9cac8bc65f09308080a316a4574e71ee91fdc8ed3592b8135cba38f064831

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\4.png

MD5 0d44c34c20571042f203ea253ea4d55c
SHA1 333cc13952391b4acb96b9191ea59f3fc1e521da
SHA256 27b09323f37b7877b02df789b938bd792e0a5504de9cd405c76276b19c41f60b
SHA512 1bb144dc607831bfaed82981c73b09be655448349425b89c608792b8a5ee43a7653efb2ad75afc2539093903b03916ae7bff019dc9e10a9d747942b9e97127e4

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\7.png

MD5 97c3ad3885d6c0c0174510788ec85e42
SHA1 e4ce36da271ef8028aa6b85c857536c2bccd16cb
SHA256 162b3b8729418a3925447d50b4fbb24482c82804ffa7a46eaf82b751eac10899
SHA512 3f800c998e82375fdc0f75da6f91d4175170713b4d19d43711cdacee0490e6fdf4accdbed568e75228b6c5fd443da5a93a59e8c202a5ffab09f82e2d1aab2e55

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\8.png

MD5 4b3f9cdeba108423f3c80300efff1958
SHA1 ef7fa256ae3441a568c8f3bdf4ee5725f732af89
SHA256 6239a97e39e6604584d5d3aa05075a00ea277371b7af79e14536ae79edfa93fd
SHA512 5deb2c296d6d111543461f4d4a95db0201af3f6660194dc9ae13cd6964339bd570ac99c99d9f7f4e04bc1ec6ebc51b6adc51db92ebd63a32108811c29f3adfff

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\6.png

MD5 f35ca234c01575ae87bd0308823ed62a
SHA1 d06f45f05291cfaadb34d537f453bc0f01ad38df
SHA256 18242f17950a2df4a55cf8f19c4e0d38125f6a8a565552b8bb786a2470ede112
SHA512 7c3ffa3951c799d9ad4e494d857530381da7af700711c259bdd8bed877c2e926e9100e9c0ad36ca9b67986c5956f7394369fcba461fab3badf4eebe55f5272d5

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\5.png

MD5 baf3a84232614cd8c2ee9133296f7234
SHA1 43faa2409b5eef379084c9ebd620fce00f0bb6b9
SHA256 e46f2319d3988173c1766d9ac19dadc3bf63fb98432b7c9636241ae5c356a319
SHA512 e8c0bdcb049ec3ead84a1215b34dae0512358ad85702f31ce7618712d8f4d9afc86eb823b20090db5354463eaa6c1225cd4f1fd95ed1b7e11765bbd22b798575

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\41.png

MD5 53cfb99b1b1ce106ba18051e28b5fb8b
SHA1 9717abeda7046973b6162ea5593e2c71d45d5cf7
SHA256 d0106f503486aea379cec27d4df6b84f26e1cb312613e2762421a428e85c3ed1
SHA512 24b2e8f766c3a4fa7c4cfb47882acdff6c59eac349834cc9302ff0bf5475f568591f81dd3f6d8df93a4d9eec6c556ca74c9bfe9f3f233b1e413bf70dca0cf3c1

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\40.png

MD5 29dac7dba26b3f49231e9d38d28ce84c
SHA1 0ef797529ce2b97a0d366333cd891812f7584709
SHA256 46a41b720beb99aba5643675c42a3882dabad5e8d7199de37b1ab2360db3d0b1
SHA512 b01478523f89b5f006a562e93f48a8b64e18d256c48dfc2c26cc89ed6cfb33ddb742a4d34683b88684b79fe88dca7d3583023b71dbb2909445af94b5b52211c8

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winhelp\usermanual\css\dynatree\vista\9.png

MD5 c1a44e8bce9ed3d25e95b6f15f08721e
SHA1 bed5e6825dbaaddbbcffa255d67693ef0961b724
SHA256 a1590194311c386a5c8659c0b763a7ee45cab9639b526d2a822776035317ee02
SHA512 75a5293db695c242b25334b17e9653ff1a5f73f68238217d808596ed09df9f122853dd48cd39b2a0e4ec98487ab55ac1049b3c913e31887fed7c1660083bf4bb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\xxcleanup.txt

MD5 04a9c9258e3ca67142c2190e0b457978
SHA1 05c84cff023fd37c880b60d573530560b3ba9ca7
SHA256 95b1ca34006643256ce7c2a259829fc6f65947251844614b690957b5307f6719
SHA512 d158358ed74069b4aba29729086f729b982c2d7365ec7d8a7f76b14113671b6fc6783a90845b11bf312863c881df4e6aaaef403680cb729912bd1a8d675051c1

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\x86_64-efi\crypto.lst

MD5 6a3f58db454b17a0a339323b3e134a6b
SHA1 ff00d28114398cf1a052329494d63aceeb8ff29a
SHA256 1b766f38a94927fe9b7bc1e809f0363e778e14c601e800faea271a2e75d3fc43
SHA512 7488c4b6c106c8658a308e514b6fd03e6642f201737fd2716831733d98c3d686beab9903d36b0b2e9e30b3c01f2bd9757f30605d318215878a2b932ec4ab5ebb

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\x86_64-efi\fs.lst

MD5 4f72bc2bcabe379b4fe0f7e1bbd03c04
SHA1 f091655c7ac7314eb0df21931415de47628d621f
SHA256 32fc7f5de8c0a5dc0b1e7eb609ca31a77eb3475539e1d97a4543dca1b9b26c57
SHA512 930e8cd4d3e74f6fe9f7a66b93abb846624f1eecfddff45f943dd20e86da06ac55dc3f4226a2b2de15285746365d6fa8112737bd2d75a364a28fc38a28a6f552

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\x86_64-efi\partmap.lst

MD5 02b988d7196362ddf27caaecf35c23dc
SHA1 b5a777a9c9d1d484b9f133987047bca324a9c01e
SHA256 85a3d5f84d20723a27c1442b861be44fbf58a4525eefe2ccbb2b5f7ceb21e8be
SHA512 4efa28eb28d06d4fdc7de8086910588359f7013a47f199a8e6af037fdcfcaeb535124417cdafb8d1d417aa9a09123a59525a6bdefddc5d1939aada231e606e91

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\x86_64-efi\parttool.lst

MD5 3190a91d3075032543740d0998971d77
SHA1 408f07c267ffdb9554b69138616a472fe4207026
SHA256 6de6036ef0dc8a908e4cc248ef1d8aab87172e722d8c5bad9e137fd43994e0fe
SHA512 6fcbf3a8135d075bd23f0737a8d50327f2fd585738b5439968d0c0448b9e19ac74cfecaf483bf323433effe2c460e563ffc0e5a6aedd7f2bf8a30ea4b52bf038

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\x86_64-efi\x86_64-efi\core.efi

MD5 2f117cf85668e3cb77ddc79486378a48
SHA1 841a1e185de4cfc8ae6991e8f27a0b1dc9a0e9db
SHA256 34a3088e15d5acff1a25bec07109b18d17f2fe6b07ca1cccb261234ecccb0fcc
SHA512 75c6d7196ca89a51d0d9298b0d77c7e1fcfd062d10085a187bf6c7d08c93481e3bb93be51d3a4ba8487cda8a56060200448fab2f057536fd202de64ce5f99e3d

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\x86_64-efi\x86_64-efi\terminal.lst

MD5 098832497928edecd396096490b430de
SHA1 66b726c6d64bc109d3948a9528f502ea94938ef4
SHA256 46f888c52f36baf9b62d60bc8d06426a314aad5a0ff86a4362a91c2512a1df9c
SHA512 4fdd3b4cb38c5c69865033bca010d6b914ddfb74dcc5886b258fe4fa8759a1160ec4b924a1c7a7128b0f6899e6f3b0e33373a1ee7532e533e9b6b1629e52533f

memory/4736-3316-0x0000000000070000-0x000000000038D000-memory.dmp

C:\ProgramData\Grub2Win\315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf.exe.24061820055456\inet.work.internet.txt

MD5 aa43a7da2ac1c4c3a62c134ba0ec03b2
SHA1 a4c2aa7a312975ad468d60285298af9438881e65
SHA256 d2d632846dd5563a25b13783888448fc93016baaca3871cdeb1ecb1e28d5ebcb
SHA512 d1480b9e35c9d8e0c6941654f0a3845cb2ddabd99f2e5dec2bcd9152cd7a0ed9b69cd57fe6c395ed7b085efb0fca7ea4f9e1bb3b706dd17c31ea8a908d0476d9

C:\ProgramData\Grub2Win\grub2win.ExtractTemp.24061820055456\install\winsource\grub2win.exe

MD5 2888f530d3e01fc2901e3183aa81d308
SHA1 f77b10eb25fe53d02919757ac5caffda426b22be
SHA256 922ccb25b4ac7693487181af29d3bafbdff71ac318348eebdf32ee3d94f030f9
SHA512 0ea55e2f6777a302c934f622209a51cb2bbe82c8d0642a56078438f4b3212d21e5b05d4d3d23e93869a4581096b8091551651c97f34d65ef687cad0867f31836

memory/2596-3329-0x0000000000580000-0x000000000079B000-memory.dmp

memory/4736-3328-0x0000000000070000-0x000000000038D000-memory.dmp

memory/4736-3331-0x0000000000070000-0x000000000038D000-memory.dmp

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt

MD5 b79fbd6daf1b05c5fe132a183e242504
SHA1 cf37299bd587ff61010f0d9e83566f11ac9bc624
SHA256 1cb5d9d78ca0e30c9e4b6cb0a5838d927792a54b9930308e604dfd9a9a43fe8b
SHA512 0dcd359619806b54398c123d903556660de510bf20372eef69835c96560644b14abc5d7f5ede638866068a462a704ce1d04aa19e6a3240d6dfa815607ef184e9

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.output.txt

MD5 55dc30fc0aa4e9292f33e647c0185458
SHA1 e77cb7b18f94f4e4973b4a0300d0eab31dba1a1f
SHA256 0e81a9398e2e531ccd63eceb55594974538430dfe2adf55c4c484a68e0fdd9cc
SHA512 9c43986977ccf06a16d47df869bf8e1e0dfe08d7463b80e61363e00fc6e7068a0b592e02fa0dc2c3cc006f603dbe1ae641462d206ed691140de7f000229131b3

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt

MD5 e8927b03efcd1ea1b567f9d8335bd927
SHA1 1f5f208fe823c728da04bbd4440b520bf0fb45c6
SHA256 f966e7559ea2a95e7c6d2f7827f36f478362bb736e0502754b0ecf1954c75040
SHA512 9b2b7c08f2496a2dcb84eb527bcce90ef0112250abbb9b7282278bbd68e960274ce642b6c50464e4f43fd7ddf12fbfc88d712533dcc2e582a5ee3e5fbb98adc5

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.output.txt

MD5 9d92ea25af280ced2db3b6995e84afcf
SHA1 2cbaa53f53d9e68582424d1abb94aed05971a7f9
SHA256 a2641a5b91a0148cb3933933feb18b11de03a0ff2ba0aed6066d0709dfb4dee0
SHA512 8eba5f42e04fed8439c7bdcec28722ae2658ee093cdb69e4902de962e794d6b8b03be7466cfb7698a45ba99679100b9a025f0e4a86c7b30fea95ad9114bf9844

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.security.output.txt

MD5 c5f391be9e8bdc0ab1a4ba2c80b7cbf1
SHA1 7407d8ca672be8194f74e8c734a64ffdbabdd57e
SHA256 059f065dbf5cbf605c78de731a91db5a5229b41a0bbce1e50048ee0983850545
SHA512 6bcf978b6ee1bc199b9749d0296e0d5966b383beda1fac6a9d63442e85cba0aa69b99dda190a090044d3bfaae7e6f030eb80ead60c3beb28b983e9a34f4ed361

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.security.output.txt

MD5 04d134900b0b9c7c72b5942a7afc151f
SHA1 624e50d0a2143fffe0ec5fab0735906a30ae5514
SHA256 01d225329f3e5d6a35a5c5890e7a715ef6d2950434dc16038a23ee6cf9e4730a
SHA512 70196e89e85ca2e76c2de799c36fb3527b32b1b4065ab22e33bc3816e60d72d574aee34bb4e1f9d1f797c654fd684bcfa117d61f0b3d67b1fc1017a38ac87eb9

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.script.txt

MD5 70b06ea089ea5038168ef2a662a77f31
SHA1 86e57abbc41f01b108ea39942a1a298091bb045d
SHA256 d2284fcdd778f48ed3d0fa3be2dc76d4b245442ffe1afacb8f58d0d4001a709d
SHA512 ebbde155e219df5c74b95e6be8257ebf99cf4d94322cdf7a38025087769f8f81ba1379fb01863f35300d8e7eed10fa23e6883f582cc9ff7b90d7042c29570a1f

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\direct.diskpart.output.txt

MD5 da5911b79caa2e9a7c0a348c35ca1638
SHA1 a7bb8a839cddd98822294ce3096011f08e6dce62
SHA256 941f032c1db01c9e60705c7ae5a38e3aa7a3a47c968fea0b4b57dd3391a3412b
SHA512 16101ec9574880dc14b1d281a665bc823bc44af33c79352c5cf0cd3abd371b8cc5141f050c0bf1760639dfbdf4997bedbb9a648e615c222f2e5df624f27932ce

C:\ProgramData\Grub2Win\grub2win.exe.24061820061669\encryption.status.txt

MD5 2bfca6f52799fea70c73d0d98eb1c5b9
SHA1 f643bc11e3f459b0da01ac52c1aaba068ce14199
SHA256 4f0c357415b700b775b6838503a604f7e174cc0836e1d32e9d1cf6eaa0041f10
SHA512 d81b7fb46d4befc43c77536a8ddd2417dd8e08d2714f4ff80f356ca20f57fe07512bd5c59749cd8b83bedc730d4181904db2f6f95ba2d4a9a143daaa10a592e1

memory/2596-3363-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3364-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3365-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3366-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3367-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3368-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3369-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3370-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3371-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3372-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3373-0x0000000000580000-0x000000000079B000-memory.dmp

memory/2596-3374-0x0000000000580000-0x000000000079B000-memory.dmp