Malware Analysis Report

2025-04-13 23:49

Sample ID 241104-zqy11sxbqe
Target sample
SHA256 7909ad298eba1b0e68c4e7a905563960e39bf5fdc324663e91dc9bf1af7e4565
Tags
discovery execution persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

7909ad298eba1b0e68c4e7a905563960e39bf5fdc324663e91dc9bf1af7e4565

Threat Level: Likely malicious

The file sample was found to be: Likely malicious.

Malicious Activity Summary

discovery execution persistence

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Command and Scripting Interpreter: JavaScript

Browser Information Discovery

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Enumerates system info in registry

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Checks SCSI registry key(s)

NTFS ADS

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy WMI provider

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-04 20:55

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-04 20:55

Reported

2024-11-04 21:06

Platform

win11-20241007-en

Max time kernel

597s

Max time network

602s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\sample.js

Signatures

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Windows\msagent\AgentSvr.exe N/A
N/A N/A C:\Windows\msagent\AgentSvr.exe N/A
N/A N/A C:\Windows\msagent\AgentSvr.exe N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
N/A N/A C:\Windows\msagent\AgentSvr.exe N/A
N/A N/A C:\Windows\msagent\AgentSvr.exe N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
N/A N/A C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet" C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\msvcp50.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\SysWOW64\SETAE41.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File created C:\Windows\SysWOW64\SETAE41.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\BonziBuddy432\Regicon.ocx C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Snd2.wav C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page1.jpg C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ba.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBDY.vbw C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\da.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\RACREG32.DLL C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ro.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\License.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page0.jpg C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Reg.nbd C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
File opened for modification C:\Program Files\7-Zip\Lang\uz.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page0.jpg C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\readme.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\si.txt C:\Windows\System32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\az.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\empop3.dll C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Snd1.wav C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\t3.nbd C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\az.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ca.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\va.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\emsmtp.dll C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eu.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\bn.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ba.txt C:\Windows\System32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\msvcrt.dll C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\sp001.gif C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\io.txt C:\Windows\System32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tk.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page9.jpg C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\th.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Windows\System32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tk.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ku.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ka.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uz.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page6.jpg C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ja.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ja.txt C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\en.ttt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\BonziBuddy432\SSubTmr6.dll C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tr.txt C:\Windows\System32\msiexec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ar.txt C:\Windows\System32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\msagent\AgentAnm.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\lhsp\tv\SETAE1D.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\lhsp\tv\tvenuax.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\INF\tv_enua.inf C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\msagent\AgentCtl.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\AgentMPx.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\msagent\SETA72F.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\Installer\e5b25a5.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF0212EF42CA7675A2.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\msagent\SETA71A.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\SETA71B.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\CacheSize.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF419E4FF7BB08BDB9.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFD08DED8F3A942258.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI17EE.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\lhsp\help\SETAE3E.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File created C:\Windows\lhsp\help\SETAE3E.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\msagent\SETA731.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\SystemTemp\~DF965F0DF032634BE0.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\msagent\AgentSR.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\INF\SETA730.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\INF\SETA730.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\lhsp\tv\SETAE2E.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File created C:\Windows\fonts\SETAE3F.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File created C:\Windows\SystemTemp\~DFD46B1C9042B5C850.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\msagent\SETA719.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\AgentDp2.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\INF\SETAE40.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFA0656BD780617A4A.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFC22169B354AAC085.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\msagent\AgentSvr.exe C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\msagent\intl\SETA743.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\msagent\SETA72D.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\SETA72F.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\help\SETA732.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\help\SETA732.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\fonts\andmoipa.ttf C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\msagent\SETA72D.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\Installer\MSIE1A3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\msagent\mslwvtts.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2201-000001000000} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF9D07FFB7113C972F.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\msagent\SETA718.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\AgentDPv.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\lhsp\help\tv_enua.hlp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\msagent\SETA718.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\intl\SETA743.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\lhsp\tv\SETAE1D.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\msagent\SETA71A.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\AgentPsh.dll C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File created C:\Windows\msagent\SETA71C.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
File opened for modification C:\Windows\msagent\SETA72E.tmp C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A

Browser Information Discovery

discovery

Command and Scripting Interpreter: JavaScript

execution

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\msagent\AgentSvr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\grpconv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\grpconv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\msagent\AgentSvr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\ielowutil.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000089ac4f3df1c89d300000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000089ac4f3d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090089ac4f3d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d89ac4f3d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000089ac4f3d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437518892" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F474633-9AEF-11EF-9714-FEA1978CE90E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31141728" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "954397432" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133752273897503051" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D0ECB23-9968-11D0-AC6E-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\msagent\AgentSvr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinSource.1\CLSID\ = "{53FA8D44-2CDD-11D3-9DD0-D3CD4078982A}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE11629C-36DF-11D3-9DD0-89D6DBBBA800}\ProgID C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D4E-2CDD-11D3-9DD0-D3CD4078982A}\TypeLib C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5AA1F9B2-F64C-11CD-95A8-0000C04D4C0A}\TypeLib\ = "{E8671A8B-E5DD-11CD-836C-0000C0C14E92}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5AA1F9B0-F64C-11CD-95A8-0000C04D4C0A}\ = "ISSStyleSet" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37DEB787-2D9B-11D3-9DD0-C423E6542E10} C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl\ = "Microsoft ListView Control, version 6.0" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62FCAC31-2581-11D2-BAF1-00104B9E0792} C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4ABF875-8100-11D0-AC63-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7AE600-0142-11D3-9DCF-89BE4EFB591E} C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{643F1352-1D07-11CE-9E52-0000C0554C0A}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DECC98E1-EC4E-11D2-93E5-00104B9E078A}\TypeLib\ = "{0A45DB48-BD0D-11D2-8D14-00104B9E072A}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DACB7A39-CC0D-4B85-908B-10D2451761A5}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{916694A8-8AD6-11D2-B6FD-0060976C699F} C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{916694A9-8AD6-11D2-B6FD-0060976C699F}\ = "RegiCon" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F55ED2E0-6E13-11CE-918C-0000C0554C0A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4900F95-055F-11D4-8F9B-00104BA312D6} C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSPanel\CurVer\ = "Threed.SSPanel.3" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC0-E669-11CD-836C-0000C0C14E92}\ = "_DSSMonth" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4900F5D-055F-11D4-8F9B-00104BA312D6}\1.4\FLAGS\ = "0" C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\MiscStatus C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB52CF7D-3917-11CE-80FB-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D47-2CDD-11D3-9DD0-D3CD4078982A} C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53FA8D4B-2CDD-11D3-9DD0-D3CD4078982A} C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar.2\ = "Microsoft Toolbar Control, version 6.0" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\FLAGS\ = "2" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE1-7DE6-11D0-91FE-00C04FD701A5} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7AE601-0142-11D3-9DCF-89BE4EFB591E}\Programmable C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\ = "Image Property Page Object" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC0-E669-11CD-836C-0000C0C14E92}\TypeLib C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Programmable C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BD1-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtl" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D12BA0-5B77-11D1-9EC1-00C04FD7081F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\msagent\AgentSvr.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4900F6A-055F-11D4-8F9B-00104BA312D6}\TypeLib C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA478DA1-3920-11D3-9DD0-8067E4A06603}\Programmable C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D4B-2CDD-11D3-9DD0-D3CD4078982A} C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5AA1F9B2-F64C-11CD-95A8-0000C04D4C0A}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4ABF875-8100-11D0-AC63-00C04FD97575}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED86423-10D4-4CE1-8C84-9C9EC1B43364}\ProgID C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F581B2D6-E4C3-40BF-8A1E-F68CDFD8FEEC}\ = "_clsRegistration" C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BD33B25E-E99D-40C3-B5C5-7F5C3F130777}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8671A88-E5DD-11CD-836C-0000C0C14E92}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B2676D5B-8D53-4569-AF2C-A55A0D90C132}\TypeLib C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{159C2806-4A71-45B4-8D4E-74C181CD6842}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0913412-3B44-11D1-ACBA-00C04FD97575}\TypeLib C:\Windows\msagent\AgentSvr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22DF5084-12BC-4C98-8044-4FAD06F4119A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4900F66-055F-11D4-8F9B-00104BA312D6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37DEB787-2D9B-11D3-9DD0-C423E6542E10}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA478DA0-3920-11D3-9DD0-8067E4A06603}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1533A365-F76F-4518-8A56-4CD34547F8AB}\TypeLib C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSPanel C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE6-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinEvent C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC1-E669-11CD-836C-0000C0C14E92}\ = "_DSSMonthEvents" C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DB2224E-D2FA-4B2E-8402-085EA7CC826B} C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\Bon.zip:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\msagent\AgentSvr.exe N/A
N/A N/A C:\Windows\msagent\AgentSvr.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3168 wrote to memory of 4468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 4468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 3576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3168 wrote to memory of 1036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\sample.js

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdaf99cc40,0x7ffdaf99cc4c,0x7ffdaf99cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4408 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4600,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4584 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4596,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4424 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3544,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4588 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4784,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4688 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3504,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3316 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4320,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4944,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5296,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5332,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5312 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_Bon.zip\BonziBuddy432.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "

C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE

MSAGENT.EXE

C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe

tv_enua.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\msagent\AgentSR.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"

C:\Windows\msagent\AgentSvr.exe

"C:\Windows\msagent\AgentSvr.exe" /regserver

C:\Windows\SysWOW64\grpconv.exe

grpconv.exe -o

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll

C:\Windows\SysWOW64\grpconv.exe

grpconv.exe -o

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzibuddy.tk/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdb0083cb8,0x7ffdb0083cc8,0x7ffdb0083cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,15464210733232386388,9644035414498653513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8

C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE

"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"

C:\Windows\msagent\AgentSvr.exe

C:\Windows\msagent\AgentSvr.exe -Embedding

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x0000000000000480

C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE

"C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3240,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8

C:\Program Files (x86)\Internet Explorer\ielowutil.exe

"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4032 CREDAT:17410 /prefetch:2

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe shell32.dll,Control_RunDLL speech.cpl,,0

C:\Windows\system32\RunDll32.exe

C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL speech.cpl,,0

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5124,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1244 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5748,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5812 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5944,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5936 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5920,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5928 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5172,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5956 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5516,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5344 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3432,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=3488,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5960 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6260,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6244 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=3104,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6388 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3216,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6396 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6604,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6356 /prefetch:8

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=1456,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5796 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=5144,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5688 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4968,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6508 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6012,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6660 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6440,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6512 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5728,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2724 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5488,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6728 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6172,i,7638154531950800432,17875077085176529526,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6484 /prefetch:8

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc

Network

Country Destination Domain Proto
GB 142.250.180.4:443 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 216.58.201.110:443 apis.google.com udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
GB 142.250.187.206:443 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
GB 142.250.178.14:443 play.google.com udp
GB 142.250.178.14:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
GB 142.250.187.206:443 play.google.com tcp
GB 172.217.16.238:443 consent.google.com tcp
FR 151.106.4.82:443 bonzi.link tcp
FR 151.106.4.82:443 bonzi.link tcp
FR 151.106.4.82:443 bonzi.link tcp
FR 151.106.4.82:443 bonzi.link tcp
FR 151.106.4.82:443 bonzi.link tcp
FR 151.106.4.82:443 bonzi.link tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.14:443 play.google.com tcp
GB 142.250.178.14:443 play.google.com udp
GB 142.250.178.14:443 play.google.com udp
FR 151.106.4.82:443 bonzi.link udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.187.226:443 ep1.adtrafficquality.google tcp
GB 142.250.179.225:443 ep2.adtrafficquality.google tcp
GB 142.250.179.225:443 ep2.adtrafficquality.google tcp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net udp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com udp
GB 142.250.180.4:443 www.google.com udp
CO 142.250.78.3:443 csi.gstatic.com tcp
GB 142.250.179.225:443 ep2.adtrafficquality.google udp
GB 142.250.187.226:443 ep1.adtrafficquality.google udp
US 172.67.138.185:80 bonzibuddy.tk tcp
US 172.67.138.185:80 bonzibuddy.tk tcp
US 172.67.138.185:443 bonzibuddy.tk tcp
US 151.101.130.137:443 code.jquery.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
GB 142.250.178.2:443 googleads.g.doubleclick.net udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
US 54.183.50.132:80 www.bonzi.com tcp
US 13.56.35.109:80 www.bonzi.com tcp
US 104.18.33.97:443 opensea.io tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com udp
GB 142.250.178.2:443 googleads.g.doubleclick.net udp
GB 142.250.180.4:443 www.google.com udp
GB 142.250.178.14:443 play.google.com udp
GB 172.217.16.227:443 id.google.com tcp
GB 172.217.16.227:443 id.google.com tcp
GB 142.250.180.4:443 www.google.com udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
IE 13.224.68.66:443 butterfly-on-desktop.soft32.com tcp
IE 13.224.68.66:443 butterfly-on-desktop.soft32.com tcp
GB 142.250.178.14:443 play.google.com udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
US 3.165.224.99:443 d3gx3uz4yj2hnq.cloudfront.net tcp
US 3.165.224.99:443 d3gx3uz4yj2hnq.cloudfront.net tcp
IE 3.162.143.77:443 d22blwhp6neszm.cloudfront.net tcp
US 3.165.224.99:443 d3gx3uz4yj2hnq.cloudfront.net tcp
IE 3.162.143.77:443 d22blwhp6neszm.cloudfront.net tcp
US 8.8.8.8:53 99.224.165.3.in-addr.arpa udp
US 8.8.8.8:53 77.143.162.3.in-addr.arpa udp
US 8.8.8.8:53 d3fnqfpn2r2a3x.cloudfront.net udp
US 8.8.8.8:53 www.googletagservices.com udp
GB 216.58.213.2:443 www.googletagservices.com tcp
IE 18.66.168.124:443 d3fnqfpn2r2a3x.cloudfront.net tcp
IE 18.66.168.124:443 d3fnqfpn2r2a3x.cloudfront.net tcp
IE 18.66.168.124:443 d3fnqfpn2r2a3x.cloudfront.net tcp
IE 18.66.168.124:443 d3fnqfpn2r2a3x.cloudfront.net tcp
IE 18.66.168.124:443 d3fnqfpn2r2a3x.cloudfront.net tcp
IE 18.66.168.124:443 d3fnqfpn2r2a3x.cloudfront.net tcp
US 199.232.192.134:443 soft32.disqus.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net tcp
GB 142.250.178.14:443 play.google.com tcp
US 151.101.192.134:443 disqus.com tcp
IE 13.224.68.69:443 c.disquscdn.com tcp
GB 151.101.188.157:443 platform.twitter.com tcp
GB 142.250.178.14:443 play.google.com udp
US 8.8.8.8:53 referrer.disqus.com udp
US 151.101.192.134:443 disqus.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
US 199.232.192.64:443 tempest.services.disqus.com tcp
US 199.232.192.64:443 tempest.services.disqus.com tcp
US 199.232.192.134:443 referrer.disqus.com tcp
US 199.232.192.134:443 referrer.disqus.com tcp
GB 151.101.188.157:443 platform.twitter.com tcp
US 8.8.8.8:53 124.168.66.18.in-addr.arpa udp
US 8.8.8.8:53 134.192.232.199.in-addr.arpa udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 134.192.101.151.in-addr.arpa udp
US 8.8.8.8:53 69.68.224.13.in-addr.arpa udp
US 8.8.8.8:53 157.188.101.151.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 64.192.232.199.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
IE 13.224.68.69:443 c.disquscdn.com tcp
GB 142.250.178.14:443 play.google.com udp
IE 13.224.68.69:443 c.disquscdn.com tcp
US 8.8.8.8:53 www.facebook.net udp
US 8.8.8.8:53 cdn.taboola.com udp
GB 216.58.213.1:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
BE 66.102.1.156:443 stats.g.doubleclick.net tcp
GB 216.58.213.1:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 200.187.250.142.in-addr.arpa udp
US 151.101.65.44:443 cdn.taboola.com tcp
US 151.101.65.44:443 cdn.taboola.com tcp
US 8.8.8.8:53 1.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 syndication.twitter.com udp
US 104.244.42.72:443 syndication.twitter.com tcp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 104.244.42.72:443 syndication.twitter.com tcp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 72.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 44.65.101.151.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 7369ceaf5ffce2e6b454b19550226327.safeframe.googlesyndication.com udp
GB 216.58.213.1:443 7369ceaf5ffce2e6b454b19550226327.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 trc.taboola.com udp
US 8.8.8.8:53 beacon.taboola.com udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
GB 142.250.178.14:443 play.google.com udp
GB 216.58.213.1:443 7369ceaf5ffce2e6b454b19550226327.safeframe.googlesyndication.com tcp
GB 142.250.178.14:443 play.google.com udp
GB 142.250.178.2:443 googleads.g.doubleclick.net udp
US 199.232.192.134:443 referrer.disqus.com tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
CO 142.250.78.3:443 csi.gstatic.com tcp
CO 142.250.78.3:443 csi.gstatic.com tcp
US 8.8.8.8:53 js.centerbodyapps.com udp
US 72.52.179.174:443 js.centerbodyapps.com tcp
US 72.52.179.174:443 js.centerbodyapps.com tcp
GB 142.250.178.14:443 play.google.com udp
US 8.8.8.8:53 a5cecdb27b0d7152623e3f7c9ee5e17d.safeframe.googlesyndication.com udp
IE 99.86.122.30:443 d39gqu6btbxc9z.cloudfront.net tcp
IE 99.86.122.30:443 d39gqu6btbxc9z.cloudfront.net tcp
US 8.8.8.8:53 30.122.86.99.in-addr.arpa udp
GB 172.217.169.74:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 d3jj3bqika1l3e.cloudfront.net udp
GB 172.217.169.74:443 content-autofill.googleapis.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
IE 18.66.168.97:443 d3jj3bqika1l3e.cloudfront.net tcp
US 8.8.8.8:53 74.169.217.172.in-addr.arpa udp
DE 49.12.202.237:443 www.7-zip.org tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.110.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 216.239.32.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
GB 2.18.66.80:443 tcp
GB 2.18.27.76:443 www.bing.com tcp
US 8.8.8.8:53 76.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 222.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
GB 2.18.27.76:443 r.bing.com tcp
GB 2.18.27.76:443 r.bing.com tcp
GB 2.18.27.76:443 r.bing.com tcp
GB 2.18.27.76:443 r.bing.com tcp
GB 2.18.27.76:443 r.bing.com tcp
GB 2.18.27.76:443 r.bing.com tcp
US 20.189.173.5:443 browser.pipe.aria.microsoft.com tcp
US 8.8.8.8:53 254.4.107.13.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 254.42.107.13.in-addr.arpa udp
US 13.56.35.109:80 www.bonzi.com tcp
US 13.56.35.109:80 www.bonzi.com tcp
FR 152.199.21.118:443 static-ecst.licdn.com tcp
US 150.171.28.254:443 ax-ring.msedge.net tcp
US 8.8.8.8:53 management.azure.com udp
US 4.150.240.10:443 management.azure.com tcp
US 8.8.8.8:53 118.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 254.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 10.240.150.4.in-addr.arpa udp
GB 142.250.180.4:443 www.google.com udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 142.250.178.14:443 play.google.com udp
GB 172.217.169.10:443 ogads-pa.googleapis.com udp
GB 172.217.16.227:443 id.google.com udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
GB 172.217.169.10:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 172.217.169.74:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 246.212.58.216.in-addr.arpa udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.roblox.com udp
US 8.8.8.8:53 css.rbxcdn.com udp
US 8.8.8.8:53 static.rbxcdn.com udp
US 8.8.8.8:53 js.rbxcdn.com udp
FR 128.116.122.4:443 assetgame.roblox.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com udp
GB 142.250.178.14:443 www.youtube.com udp
US 205.234.175.102:443 static.rbxcdn.com tcp
US 205.234.175.102:443 static.rbxcdn.com tcp
US 205.234.175.102:443 static.rbxcdn.com tcp
US 205.234.175.102:443 static.rbxcdn.com tcp
US 205.234.175.102:443 static.rbxcdn.com tcp
US 205.234.175.102:443 static.rbxcdn.com tcp
IE 3.162.140.103:443 static.rbxcdn.com tcp
IE 13.224.68.65:443 js.rbxcdn.com tcp
IE 13.224.68.65:443 js.rbxcdn.com tcp
IE 13.224.68.65:443 js.rbxcdn.com tcp
IE 13.224.68.65:443 js.rbxcdn.com tcp
IE 13.224.68.65:443 js.rbxcdn.com tcp
IE 13.224.68.65:443 js.rbxcdn.com tcp
GB 128.116.119.4:443 roblox.com tcp
US 8.8.8.8:53 103.140.162.3.in-addr.arpa udp
US 8.8.8.8:53 65.68.224.13.in-addr.arpa udp
US 8.8.8.8:53 apis.roblox.com udp
FR 128.116.122.4:443 ncs.roblox.com tcp
GB 2.22.144.76:443 apis.rbxcdn.com tcp
US 205.234.175.102:443 static.rbxcdn.com tcp
IE 18.66.171.119:443 images.rbxcdn.com tcp
IE 18.66.171.119:443 images.rbxcdn.com tcp
IE 18.66.171.119:443 images.rbxcdn.com tcp
IE 18.66.171.119:443 images.rbxcdn.com tcp
IE 18.66.171.119:443 images.rbxcdn.com tcp
IE 18.66.171.119:443 images.rbxcdn.com tcp
GB 172.217.169.74:443 content-autofill.googleapis.com tcp
GB 172.217.169.74:443 content-autofill.googleapis.com tcp
GB 172.217.169.74:443 content-autofill.googleapis.com tcp
IE 13.224.68.39:443 arkoselabs.roblox.com tcp
IE 13.224.68.39:443 arkoselabs.roblox.com udp
US 13.56.35.109:80 www.bonzi.com tcp
US 13.56.35.109:80 www.bonzi.com tcp
GB 216.58.213.3:443 beacons.gcp.gvt2.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com udp
US 54.183.50.132:80 www.bonzi.com tcp
US 54.183.50.132:80 www.bonzi.com tcp
IE 13.224.68.75:443 arkoselabs.roblox.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com udp
US 13.56.35.109:80 www.bonzi.com tcp
US 13.56.35.109:80 www.bonzi.com tcp
IE 13.224.68.75:443 arkoselabs.roblox.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com udp
FR 128.116.122.4:443 ncs.roblox.com tcp
FR 128.116.122.4:443 ncs.roblox.com tcp
FR 128.116.122.4:443 ncs.roblox.com tcp
FR 128.116.122.4:443 ncs.roblox.com tcp
FR 128.116.122.4:443 ncs.roblox.com tcp
FR 128.116.122.4:443 ncs.roblox.com tcp
GB 2.19.252.150:443 apis.rbxcdn.com tcp
US 54.183.50.132:80 www.bonzi.com tcp
US 54.183.50.132:80 www.bonzi.com tcp
GB 142.250.187.202:443 content-autofill.googleapis.com udp

Files

\??\pipe\crashpad_3168_WLJIGLHQQUAPGOSM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 879505cf34987d535d400695ba08d595
SHA1 9dab8eb5d7a3b50ce1e71108217df4324c8a83d3
SHA256 2feb30446ac01fb6b40c422927098895a6608ae728102946a444d2c5e80f8b51
SHA512 d05b4077c67ace2b8674e731a38b8ecc539f7920fa194fe9faf9f1ca485c0a3e2782f0b971894ab771549ee82013ad94b11c27f127f099ec6be83cfa2c6534a1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 43a9f2f1686295fbb21e42923045da44
SHA1 0a6cbbf28d26bde141db2081b88ec72de96e0458
SHA256 d99b6162448f0a9a0275501f900c7348e3cd7d529e3c1af86378d9679d89466a
SHA512 19000b6351d77e8cbd8d8b9c9c9ff654c1114a08adf6f6b2a34694a4b26220ed2ccda0b9683dea25f256af7c5f638a19f40fda0d7e29134e1510552e2d425be0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 62ad323c976a633d7668241555ae4992
SHA1 f8e8e728dd0a10151a5f69252dbdf543726bc6e8
SHA256 573d178aeae9ff61071586505fadf41f58f6b0b01b899339050e8149e3f63e7f
SHA512 cfd0bd6a597a79ffcdbf0ef6d190bc6ad727b819aa77cc6d77de8e4264025ed9b171b60c241327fa8202c5334819004de673d26d32c8854111bae09f418f3123

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4a10f2587e7091ae651aaf16aa58b01a
SHA1 9e3a0b54215e84653b95d157b2ed5f817cc466e6
SHA256 b0b6d561ca5a1bc229ad6bbf970832ec2dc4ff9afffe964d5ec35c0ddaa16def
SHA512 4762f5d09e2a7092d87df4798fc184de340bf8e00d91d2740568549a677d09f62f1fb59a8ff3b2c5501af07e2889eb19b0c571f17c35b107715bdb0e6b368fe1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 bf1b6be439fa1ed76f01a95e2c3abf8d
SHA1 9bb714ddd722d24f45cff6fbc4c449ee8b8295fb
SHA256 b4cbefeaf8e8097ada9bc54307c8b59c9104c6ce8f660c16dbd77cfadc3d8910
SHA512 bc7e348d0aef9d338329754e9f6061c50c811cefa1336f88ccaab453d8f3f474bd5c4046e197796125ed48c91e25647fd03a17dbb95cf74c79c284d863ba9374

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ab79394b6c07e9178d027ecfb6d5bf93
SHA1 6eb705344708fedda29b3cb129d1a39daaee6b31
SHA256 02049ded982591f79648c5f017b440841a73857ee5608bb7bac6eb5a82b1cec4
SHA512 1d909756a455061265dd8d8904f356d8386785e3286aa943594962b791398e2a1cd8f8d9ec3e27c596534d64896f09e9768052056a6e4b17ecf3446f3a995d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ba5ecfef6727bce2d76ba91ca1f4c780
SHA1 57a640cb0f27154f8c53d733f92416f30a79c509
SHA256 ff9637c2b686011b5fa012d5518fa4c24b1504d4c2c5573c61fcbdd470342493
SHA512 9fbfae5c32ef25b38a81bea3416ba1824fa9448bc12e269822b63692b1f68f4186f828df284d07ac5e0cfbe3bc6d864191f42e0c8b21b4c135118a2472937fb3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0d033ad9b83d31a9d569d31881339764
SHA1 046a36170df00878358c8b178012d32abb77537e
SHA256 c9a51296a1269f51fbf579ef150cb577648f31a3ec3738f99ba583e39be15a98
SHA512 40ef8b13ddfeec65582a0b5c3e0a65199a1a44e82b2d50826fdfb7641faa75081c5cca0b438f820104969b06d45482b53d929d7a4875ea950c12187f71a8bb84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6db27f113ca304c5274c76229fbc6251
SHA1 e4336662ddf2a490d2d2897d42f4257f9370cbb6
SHA256 116d23ffffe66f0f3245c42a5932e642d93bfd7dd0d2358f4b62a966439246e9
SHA512 6b0905487dbda8cf5dfd739477c276eaa0f962c8d86bac33ca27f0ed3d8667b6d7b312fc178a1f5345d4deee82e21b2aa2ebaca6142b6b7f2aeb69ebe8febd90

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9e5419f1ae85b206263571717dda2986
SHA1 7ec29db2f377fca4c1ab3ab45ef30c02ec696422
SHA256 76827f3902be00c796d5011fe0b595953118d6aea4b5ecab2dea0ce21c8ea81d
SHA512 ab30b847c8b763546737887f39785df048e83e55a81814ccd860a3d5b3278d6fadbdb731bc5253eb979cd0a1ea80ae1bb08c94abfce044f26976eb5a044e6f21

C:\Users\Admin\Downloads\Bon.zip:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0522383f825b317aeecd64c56544a9e8
SHA1 b66a76ca76f32fceaeeba8026e9ba65392a66824
SHA256 2a9b33c2cd562eb4bd080f492b358549a10823512b8afb402c2fa71e2b48c78a
SHA512 59ea632cec90d63f2327a3a4437c5939ec0f0facdf95b624aad0d803addbd2da3c8d481e3c1221e6d53b109088e9d29e087cafd010def797a4b79d24521fa356

C:\Users\Admin\Downloads\Bon.zip

MD5 65259c11e1ff8d040f9ec58524a47f02
SHA1 2d5a24f7cadd10140dd6d3dd0dc6d0f02c2d40fd
SHA256 755bd7f1fc6e93c3a69a1125dd74735895bdbac9b7cabad0506195a066bdde42
SHA512 37096eeb1ab0e11466c084a9ce78057e250f856b919cb9ef3920dad29b2bb2292daabbee15c64dc7bc2a48dd930a52a2fb9294943da2c1c3692863cec2bae03d

C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp

MD5 8e15b605349e149d4385675afff04ebf
SHA1 f346a886dd4cb0fbbd2dff1a43d9dfde7fce348b
SHA256 803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee
SHA512 8bf957ef72465fe103dbf83411df9082433eead022f0beccab59c9e406bbd1e4edb701fd0bc91f195312943ad1890fee34b4e734578298bb60bb81ed6fa9a46d

C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp

MD5 596cb5d019dec2c57cda897287895614
SHA1 6b12ea8427fdbee9a510160ff77d5e9d6fa99dfa
SHA256 e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff
SHA512 8f5fc432fd2fc75e2f84d4c7d21c23dd1f78475214c761418cf13b0e043ba1e0fc28df52afd9149332a2134fe5d54abc7e8676916100e10f374ef6cdecff7a20

C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp

MD5 7c8328586cdff4481b7f3d14659150ae
SHA1 b55ffa83c7d4323a08ea5fabf5e1c93666fead5c
SHA256 5eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc
SHA512 aa4220217d3af263352f8b7d34bd8f27d3e2c219c673889bc759a019e3e77a313b0713fd7b88700d57913e2564d097e15ffc47e5cf8f4899ba0de75d215f661d

C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmp

MD5 4f398982d0c53a7b4d12ae83d5955cce
SHA1 09dc6b6b6290a3352bd39f16f2df3b03fb8a85dc
SHA256 fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2
SHA512 73d9f7c22cf2502654e9cd6cd5d749e85ea41ce49fd022378df1e9d07e36ae2dde81f0b9fc25210a9860032ecda64320ec0aaf431bcd6cefba286328efcfb913

C:\Windows\msagent\chars\Bonzi.acs

MD5 1fd2907e2c74c9a908e2af5f948006b5
SHA1 a390e9133bfd0d55ffda07d4714af538b6d50d3d
SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
SHA512 8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171

C:\Windows\msagent\chars\Peedy.acs

MD5 49654a47fadfd39414ddc654da7e3879
SHA1 9248c10cef8b54a1d8665dfc6067253b507b73ad
SHA256 b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5
SHA512 fa9cab60fadd13118bf8cb2005d186eb8fa43707cb983267a314116129371d1400b95d03fbf14dfdaba8266950a90224192e40555d910cf8a3afa4aaf4a8a32f

C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmp

MD5 94e0d650dcf3be9ab9ea5f8554bdcb9d
SHA1 21e38207f5dee33152e3a61e64b88d3c5066bf49
SHA256 026893ba15b76f01e12f3ef540686db8f52761dcaf0f91dcdc732c10e8f6da0e
SHA512 039ccf6979831f692ea3b5e3c5df532f16c5cf395731864345c28938003139a167689a4e1acef1f444db1fe7fd3023680d877f132e17bf9d7b275cfc5f673ac3

C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg

MD5 108fd5475c19f16c28068f67fc80f305
SHA1 4e1980ba338133a6fadd5fda4ffe6d4e8a039033
SHA256 03f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b
SHA512 98c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a

C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg

MD5 e8f52918072e96bb5f4c573dbb76d74f
SHA1 ba0a89ed469de5e36bd4576591ee94db2c7f8909
SHA256 473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82
SHA512 d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f

C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmp

MD5 b3b7f6b0fb38fc4aa08f0559e42305a2
SHA1 a66542f84ece3b2481c43cd4c08484dc32688eaf
SHA256 7fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b
SHA512 0f4156f90e34a4c26e1314fc0c43367ad61d64c8d286e25629d56823d7466f413956962e2075756a4334914d47d69e20bb9b5a5b50c46eca4ef8173c27824e6c

C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE

MD5 8a30bd00d45a659e6e393915e5aef701
SHA1 b00c31de44328dd71a70f0c8e123b56934edc755
SHA256 1e2994763a7674a0f1ec117dae562b05b614937ff61c83b316b135afab02d45a
SHA512 daf92e61e75382e1da0e2aba9466a9e4d9703a129a147f0b3c71755f491c68f89ad67cfb4dd013580063d664b69c8673fb52c02d34b86d947e9f16072b7090fb

C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE

MD5 93f3ed21ad49fd54f249d0d536981a88
SHA1 ffca7f3846e538be9c6da1e871724dd935755542
SHA256 5678fd744faddb30a87568ae309066ef88102a274fff62f10e4963350da373bc
SHA512 7923556c6d6feb4ff4253e853bae3675184eab9b8ce4d4e07f356c8624317801ee807ad5340690196a975824ea3ed500ce6a80c7670f19785139be594fa5e70f

C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE

MD5 73feeab1c303db39cbe35672ae049911
SHA1 c14ce70e1b3530811a8c363d246eb43fc77b656c
SHA256 88c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
SHA512 73f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153

C:\Program Files (x86)\BonziBuddy432\Uninstall.exe

MD5 578bebe744818e3a66c506610b99d6c3
SHA1 af2bc75a6037a4581979d89431bd3f7c0f0f1b1f
SHA256 465839938f2baec7d66dbc3f2352f6032825618a18c9c0f9333d13af6af39f71
SHA512 d24fcd2f3e618380cf25b2fd905f4e04c8152ee41aeee58d21abfc4af2c6a5d122f12b99ef325e1e82b2871e4e8f50715cc1fc2efcf6c4f32a3436c32727cd36

C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx

MD5 3d225d8435666c14addf17c14806c355
SHA1 262a951a98dd9429558ed35f423babe1a6cce094
SHA256 2c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
SHA512 391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1

C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocx

MD5 66551c972574f86087032467aa6febb4
SHA1 5ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9
SHA256 9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
SHA512 35c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089

C:\Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exe

MD5 c3b0a56e48bad8763e93653902fc7ccb
SHA1 d7048dcf310a293eae23932d4e865c44f6817a45
SHA256 821a16b65f68e745492419ea694f363926669ac16f6b470ed59fe5a3f1856fcb
SHA512 ae35f88623418e4c9645b545ec9e8837e54d879641658996ca21546f384e3e1f90dae992768309ac0bd2aae90e1043663931d2ef64ac541977af889ee72e721a

C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCX

MD5 12c2755d14b2e51a4bb5cbdfc22ecb11
SHA1 33f0f5962dbe0e518fe101fa985158d760f01df1
SHA256 3b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
SHA512 4c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf

C:\Program Files (x86)\BonziBuddy432\MSINET.OCX

MD5 7bec181a21753498b6bd001c42a42722
SHA1 3249f233657dc66632c0539c47895bfcee5770cc
SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc

C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCX

MD5 9484c04258830aa3c2f2a70eb041414c
SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

C:\Program Files (x86)\BonziBuddy432\Regicon.ocx

MD5 32ff40a65ab92beb59102b5eaa083907
SHA1 af2824feb55fb10ec14ebd604809a0d424d49442
SHA256 07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
SHA512 2cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43

C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx

MD5 48c35ed0a09855b29d43f11485f8423b
SHA1 46716282cc5e0f66cb96057e165fa4d8d60fbae2
SHA256 7a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
SHA512 779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99

C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX

MD5 ce9216b52ded7e6fc63a50584b55a9b3
SHA1 27bb8882b228725e2a3793b4b4da3e154d6bb2ea
SHA256 8e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
SHA512 444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7

C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX

MD5 97ffaf46f04982c4bdb8464397ba2a23
SHA1 f32e89d9651fd6e3af4844fd7616a7f263dc5510
SHA256 5db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
SHA512 8c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002

C:\Program Files (x86)\BonziBuddy432\sstabs2.ocx

MD5 7303efb737685169328287a7e9449ab7
SHA1 47bfe724a9f71d40b5e56811ec2c688c944f3ce7
SHA256 596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
SHA512 e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03

C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat

MD5 4877f2ce2833f1356ae3b534fce1b5e3
SHA1 7365c9ef5997324b73b1ff0ea67375a328a9646a
SHA256 8ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff
SHA512 dd43ede5c3f95543bcc8086ec8209a27aadf1b61543c8ee1bb3eab9bc35b92c464e4132b228b12b244fb9625a45f5d4689a45761c4c5263aa919564664860c5e

C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE

MD5 66996a076065ebdcdac85ff9637ceae0
SHA1 4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce
SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
SHA512 e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c

C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe

MD5 3f8f18c9c732151dcdd8e1d8fe655896
SHA1 222cc49201aa06313d4d35a62c5d494af49d1a56
SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
SHA512 398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3eeaba135b81cbd937f17d7dee4c5c65
SHA1 40ad34786c52ae584a460c7c95377c9f1f2fa792
SHA256 eeaab6005e9dcdcb3642d1c0d3a11fb3343cf56f15b19f8a47b2b2f2f38f053c
SHA512 521beb800e228bbb9e38d691a5d075f4ff4389df046747babb2337cabf25d874c0bdbde1cc2bc103e90cd4005698fdd7712b5c3916a3393911a02e0604215187

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 444d0bf4cee15868922d19c19f32c278
SHA1 e43807e820f24c4f35bb31387cf3598ceb5934f8
SHA256 1af594d0cee28001daf9e90f9a7789a5a0e21194fcbc92b5e428d4390c545dbf
SHA512 098f0b92434184807e9394b4b5507e1d5b4f4e3993cc59155bb4174899f66c0adc7789cb1ebb6e9f03a694c2926c219638e4f48fa535ae79a10a65ceea42b1d0

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF

MD5 e4a499b9e1fe33991dbcfb4e926c8821
SHA1 951d4750b05ea6a63951a7667566467d01cb2d42
SHA256 49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
SHA512 a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

MD5 81e5c8596a7e4e98117f5c5143293020
SHA1 45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081
SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
SHA512 05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

memory/2860-1031-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL

MD5 237e13b95ab37d0141cf0bc585b8db94
SHA1 102c6164c21de1f3e0b7d487dd5dc4c5249e0994
SHA256 d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
SHA512 9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL

MD5 316999655fef30c52c3854751c663996
SHA1 a7862202c3b075bdeb91c5e04fe5ff71907dae59
SHA256 ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
SHA512 5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF

MD5 b127d9187c6dbb1b948053c7c9a6811f
SHA1 b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9
SHA256 bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
SHA512 88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB

MD5 f1656b80eaae5e5201dcbfbcd3523691
SHA1 6f93d71c210eb59416e31f12e4cc6a0da48de85b
SHA256 3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
SHA512 e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL

MD5 0cbf0f4c9e54d12d34cd1a772ba799e1
SHA1 40e55eb54394d17d2d11ca0089b84e97c19634a7
SHA256 6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
SHA512 bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP

MD5 466d35e6a22924dd846a043bc7dd94b8
SHA1 35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10
SHA256 e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
SHA512 23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL

MD5 b4ac608ebf5a8fdefa2d635e83b7c0e8
SHA1 d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9
SHA256 8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
SHA512 2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL

MD5 9fafb9d0591f2be4c2a846f63d82d301
SHA1 1df97aa4f3722b6695eac457e207a76a6b7457be
SHA256 e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
SHA512 ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL

MD5 48c00a7493b28139cbf197ccc8d1f9ed
SHA1 a25243b06d4bb83f66b7cd738e79fccf9a02b33b
SHA256 905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
SHA512 c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL

MD5 4fbbaac42cf2ecb83543f262973d07c0
SHA1 ab1b302d7cce10443dfc14a2eba528a0431e1718
SHA256 6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
SHA512 4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE

MD5 5c91bf20fe3594b81052d131db798575
SHA1 eab3a7a678528b5b2c60d65b61e475f1b2f45baa
SHA256 e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
SHA512 face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL

MD5 a334bbf5f5a19b3bdb5b7f1703363981
SHA1 6cb50b15c0e7d9401364c0fafeef65774f5d1a2c
SHA256 c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
SHA512 1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL

MD5 7c5aefb11e797129c9e90f279fbdf71b
SHA1 cb9d9cbfbebb5aed6810a4e424a295c27520576e
SHA256 394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
SHA512 df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL

MD5 4be7661c89897eaa9b28dae290c3922f
SHA1 4c9d25195093fea7c139167f0c5a40e13f3000f2
SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
SHA512 2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL

MD5 7210d5407a2d2f52e851604666403024
SHA1 242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9
SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
SHA512 1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf

MD5 0a250bb34cfa851e3dd1804251c93f25
SHA1 c10e47a593c37dbb7226f65ad490ff65d9c73a34
SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
SHA512 8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll

MD5 ed98e67fa8cc190aad0757cd620e6b77
SHA1 0317b10cdb8ac080ba2919e2c04058f1b6f2f94d
SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
SHA512 ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf

MD5 c3e8aeabd1b692a9a6c5246f8dcaa7c9
SHA1 4567ea5044a3cef9cb803210a70866d83535ed31
SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
SHA512 f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll

MD5 e7cd26405293ee866fefdd715fc8b5e5
SHA1 6326412d0ea86add8355c76f09dfc5e7942f9c11
SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
SHA512 1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll

MD5 497fd4a8f5c4fcdaaac1f761a92a366a
SHA1 81617006e93f8a171b2c47581c1d67fac463dc93
SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
SHA512 73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp

MD5 80d09149ca264c93e7d810aac6411d1d
SHA1 96e8ddc1d257097991f9cc9aaf38c77add3d6118
SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
SHA512 8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll

MD5 1587bf2e99abeeae856f33bf98d3512e
SHA1 aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9
SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
SHA512 43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

memory/2860-1342-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d91478312beae099b8ed57e547611ba2
SHA1 4b927559aedbde267a6193e3e480fb18e75c43d7
SHA256 df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043
SHA512 4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d7145ec3fa29a4f2df900d1418974538
SHA1 1368d579635ba1a53d7af0ed89bf0b001f149f9d
SHA256 efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59
SHA512 5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 52b86a6a99882f3ad374bccfdf591c2a
SHA1 c2c20fe83a1509eb2f6ab03a2a428511dd6982d2
SHA256 c416391045ac0c5436258958fdaefb0edb67798ea0bd16d878fd8fba40be2906
SHA512 389d36ee142a3826e55c332d7691d7b664d7a376b5d4f40ab1dac9158c3dc5d9d66bac163c168b78cb7de9e5bcab03b18c260bb6acc623112eb23d56eef55c28

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3c331c83a0f80b545cd8cc03f1de0b91
SHA1 2a81938d1410b147091557695b89b9a986603a85
SHA256 0cfbfadd1e8961f98eb20f2087f2d4ec0e33368b0deebb3ce5b4ed313bcf7003
SHA512 5e9c773c85c1411420f2ddb973765c489f0f2f3434d7115a048d8438073e81aca612f2d3c61d2bcbde427d8723f0a48a3b9228405ce270558f6efa8bcc7a9b3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 baf9818d0f260640e84497af007d8833
SHA1 25e79f039c3e240b58326dbee1575c110fd5a302
SHA256 8d990cad28464c537640f674298f142494f2b87e51d1fae36ba91aaeb9a9532b
SHA512 2ddbf29f0b764529e1cf4976bf84cfd195bc54ca0c6f0203d24e5cccf104e0fcde3e483879603b96d1dc70cf1dbf446ed099ba2ceb1badcd04f6d359811779d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 eaf47d31ef5a12af45034a526baeb39a
SHA1 5cb5f8475585e5181d9d4a92074415ddcae5f740
SHA256 f9002b3ab346fe47ab1fc879c33fbed47096dc20095a04a63f26d5b184e14c0f
SHA512 060bc94f0a68e25df5d590ef132ab91e4ed5e7e096dbc1ae7ac5c434411b061e1320e8c887a746d6e3c7ef9b8c6395a389e9331fe2ad89f13c2e2b2af9d70157

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c4fdeac50e5870be5495b96e3bab4ba1
SHA1 0e334fa3d72f47c302956155200c88c4e333a484
SHA256 e1cab6d100e79c1e74e44708f151c22d2eb57d8576eebeb9c02976f137646963
SHA512 5dbd46e2cc83c9b69dca0b9ee999126197aced9df5df809cb1b124b74d633d1aa751811dacf939c0ea4a5d1291f8248f784beecff2bf5e84731c9064c59b682b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 635e2eb3dfcc7054493ddaf5ce97b8db
SHA1 e0c004057750a472de24307a8bd8e477dda8cc82
SHA256 99f710fa6d088c933e92d27dac470014c629323068fd1e517f78909fe9f153dc
SHA512 3e416131e6b8bb06c5eb1dca8ce41636c1b894431b9630212eaea6a4543dd5f246035c8509d3a56eeccdde32b522164c912ef59143ae0ee118e64618347a03b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7813ce677b86bd529cfc721cd123e563
SHA1 6577b0ad6b10c9cfc4dc962a97f57f69f771ce75
SHA256 8dca318a43c7806a01671b61bc3e357c6774f375d2888f30b62422806efc6cf2
SHA512 62a81f31a215d49a0d0256636c0812f090eeb87ae3eb3310c7c4743f6356f46cf1e40264059b48d4acf494813d50ea03a557fcc577907a9b3086da0f5463ddf8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e605840c6ccbb11763fd5bb8184a82b7
SHA1 a9f3503f28b0d2cfc24bd21e0e251be757c09e45
SHA256 9b486b80fba6df2cd402f87f097accda58c44a7f485943fae6bf927bc7a129e9
SHA512 dbc734d8eb468865f675b416f21aef0d07b8d715efc07a86cd688d936aead179864e97ff28fe12116123f0f223464c33d8339f126cff5215cd26d7991e81666d

C:\Program Files (x86)\BonziBuddy432\Reg.nbd

MD5 a8ed45f8bfdc5303b7b52ae2cce03a14
SHA1 fb9bee69ef99797ac15ba4d8a57988754f2c0c6b
SHA256 375ecd89ee18d7f318cf73b34a4e15b9eb16bc9d825c165e103db392f4b2a68b
SHA512 37917594f22d2a27b3541a666933c115813e9b34088eaeb3d74f77da79864f7d140094dfac5863778acf12f87ccda7f7255b7975066230911966b52986da2d5c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 43c9f0ccd5e3ec9c5c69345a8c31b7d0
SHA1 4f8ff117509a604d018c38068cd065ef95e39717
SHA256 7ac764582117d246a66ddf96224dfc378b715934f0502f254ba84ef3980f890c
SHA512 03a92dfba9181d9b808bfdf053c78b06fa96174b1a6699e1e72cdf88c6bd51952aa5313b9d20159a1395da32ec68b5be60df46ab350de6fbbe8896d1fdb9f7b5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ce739e1ec2c6dc61ff1e8c05dd358049
SHA1 63a0a72f1d7f47f00f9671a74fe2ffd621dc07ed
SHA256 25b650ad977b9c0798534da75b0cd5315fb453b4261953cbbdbec902ec087967
SHA512 ddd23fe980611ec1f1d6b86ba042bc9e1da69e3df4df17fce9c8de6bead9c081d358ca6434ec7097c28384e4b06861c675009aac917863fe3db6b768f35b7e26

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5 d222b77a61527f2c177b0869e7babc24
SHA1 3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512 d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

C:\Program Files (x86)\BonziBuddy432\Reg.nbd

MD5 4de674e08ea9abd1273dde18b1197621
SHA1 7592a51cf654f0438f8947b5a2362c7053689fd8
SHA256 56010f4c8f146425eb326c79cbad23367301e6a3bc1e91fdcd671ce9f5fc4b63
SHA512 976d5772c2b42616cf948f215a78fa47d8154798abf1148f7f750545ed3de9ec1ecdf2e7e16b99c1459e5519a81301b9c1e6864e992a807b78257f0abaecc4c8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 443b6ae95c4623adea6d736ebca9d30a
SHA1 eb034b273822e92098f80a600ba80d155c2ab2cb
SHA256 4c46cca207a32d8d536f7690ca93b17ff56a591b95bebad81c99d1e5c4765344
SHA512 8feb8c4477ee7da2455f2faf8d962fad5cbf2a318977e125f26b20f3ffc89377122d8dc80c49d492a165783cc58cb3fa66bc187726e2cca4c710ad4bda712238

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3dc0da337483db3a9cbc8709902c0fd8
SHA1 1d9df4ee61eaa26824887f3b417eeced63e3323f
SHA256 b90746d4aea39d7168c7221da95da77955420a874df58d0159dc97b447e3388f
SHA512 f419709d59105f935a6147e0fd1fe50dbc6877b84b9677bfc6fce968291a7f2d555d85e5367666df000269ee1a6397a9b5e0672cba041f99d0badcc30ff47546

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a8c8a21fa8ef5de6b76c1311c178bdbf
SHA1 8c36eaccc97f4930186a64a25ac8dba63e678acf
SHA256 625e470a1b9bf1b36d57c24422f0ff3ae550e4fcb743f2adacf273cd93d8802d
SHA512 fc2f2324eb7a9c2c82140d685eb7111155183d164d2e365e2fa52837c8cc8362a90ece5d2f1cac1f9fe5e2c23af1102305faadd71c27d2396fc3e5e3d1f7bd30

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b4092f2dc23cd9906487424a90386295
SHA1 661c6caf2c5eca3fbcb4156c56bc4380323ac91c
SHA256 cea165560987b51c8d9ec51ec234cb750495e339d0ae1335b7f11497ff383701
SHA512 5995e9268ccd569c6ba0bd39ade26d8728a102ff83a6f6bfc1047d66ed8797d17d00a3f8efe63a67647933b4902a20ec239ca613f3a226feddedbdfb9b98e45d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 bf6ec30d807ae1c58bc6db4ef737cff2
SHA1 857a9cfd648aac883b370931e510aea60e8a5b2c
SHA256 4f236720fee5452067a6bb435ba49f69a85b098c9fe6c6bc6024846dbbafd981
SHA512 47997ea6a921b992249a2dac4921986f1e5db38153d65eaf577fd1152add23a87e079b56f607bbb28696bc4700267f833c5e99a9dd57fe4ee2bc8e8ff30e6a8f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e1541d8855f994ad071fb8f49ab59a9b
SHA1 0b7026ac24e2fe62a5927cba6d596f81efe674e3
SHA256 2530e397befd8aa5d5d6da25afe3cb0403a43515ad449a735920b5e9c7b741fd
SHA512 e805d3238b70964dd0575ff2536ae29c34d6ab5b17f32d8ff31b51e7e8f3443b1469b279a519432fe2455e7bf4b053c31d6a5d555394b26bd9a2285a04fa93be

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 741155a9aa04ae4966d026b429f7ac29
SHA1 224bee658ff4e5a741dbc51d548ff66a8b161f33
SHA256 bc54a920b1edbe391e61ebddccb7ddcc0c3c98cce27d0662bd483701da4f2a01
SHA512 9b8400852b1401f3ab79be82b19c2df1ea41141efb6672cd9ec0cec16b42c48dd07e0b70c1c5bddfc8b3237f220087f18979470132a9a7663659a827889936cc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b0e04315ff90ee4dcacd1bbf8e018e08
SHA1 b3c7b52e5de270d77cb9cf1a3d924d6452b3715b
SHA256 d09d3e0c3bb32d78f7c8ef7e2de73b2c6088f58661a196161f8348d1be24ed0d
SHA512 054bf42c09a899231e6564e1cf93c8a78cfb4ac2c5f8ac078394c74ab4ee56b7e0b6ec201c007744c462778356f427ddb7c655798904385d532c1abdcb838a0c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 6adf89ecbfab417e3a498c16a50e9c92
SHA1 ebf9529a7baca463462bc867b2a7f94a42e80f3a
SHA256 5303c7e3db49df7af5757ed8f8cef7823fa7a862473fe8dbcc726449155f5b18
SHA512 d175f051d8a8e578c7d931e3682a4da0db45e69b8653b7283cb49431f0d9c1b4a325bc88da63e73ee3600a4b02518b995a6d416d32eb432522ac28d3c4fa7238

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047

MD5 8083ce83edae35e3337f7f26b52c08dc
SHA1 187958eb3fbd9b44ffd1d2223ab9f63dbf4be728
SHA256 d014283ecbb1e069f80a07b4c356824bf0408ac2599a850e69557c82fed649f4
SHA512 26c7319e00084e9bafb0370bbb2b6fb5b716352dd35ef97a842893e816361a88d4adb3a618a71d9921e39c30d077a3723240d390223d4db840015b512b099c84

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7FCNBGRZ\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ee76cda386f64b3253b7fb10982a3202
SHA1 6f2779100baf4a69235d6c8e1cb6f8d9da20c73b
SHA256 d0256d928eab31200a1f401999f4fbcdee1396c26fa4062253e1ee8121a7ff12
SHA512 563bbed11c94747c94e36eb3f5f4dc09ffa7a088252ded7f77b467ab1c79c4f8d2649664b005229c53500fae6b767ad2ebc1abb2979e3d8d396e7bbc8fe48d2c

C:\Users\Admin\Downloads\Unconfirmed 213127.crdownload

MD5 50515f156ae516461e28dd453230d448
SHA1 3209574e09ec235b2613570e6d7d8d5058a64971
SHA256 f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca
SHA512 14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3146c516126d53718cd19cebf42edd93
SHA1 c3ad396ad6a9862aab5985fe84af4c7b5e367b6a
SHA256 9f6351722b405e3f91e37b0ecb7ccd2e65aff2ac675a8508d8df384cd8a45e11
SHA512 ad7211900c695f4d9d15d2bafa8118fcb7e5d0074eac685afd1baf2e5ae67cacc3950ec53914fcb215d232a6d72cef8d12446d243ddda827e84647a35f3af1ef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 be470a9a9099efa70ddf006d38292565
SHA1 864cada15f61c89deee4571aa062ca821692cc82
SHA256 623064fea63b895ed68bdf55cfebc0b515801010279445abd0e5e4f26be7d780
SHA512 180ae77de4723fcf91bc49fcf8febdf17c520f6a98f975539e278789a14ea8d0fa55c9c2e1c4012b8e6355febdd54bf0039b261dc9bee85e9f0e2645161b30a2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fe7bf7eff3a85e5bc94a91b354b0c3a9
SHA1 04dfd50a33cd49c68d08aee9e2d1a39ecdfa80c8
SHA256 c673bd32c20600652c75d5f4a83695453c0c10f0a8305e7dbecf5f570a52f7f6
SHA512 2a83911bca182465d4aedd6063df366e04dde9fbb4bceb47db65dcce8d0fec2714fd56047d478dbd3830c103fe2b0b5b9dd45562c2fdc59b5f1de658101dee9f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 04a8e73425f5ca9d3251866fc271d104
SHA1 fd0683f9f32a44a84949a822fb9960d7f52894d8
SHA256 c1e221fa1d7ca574129beb3dc770169381733c22dc062cfd5aaeefb5eaebb0ea
SHA512 2cdd39b0d91230f750838e73a30ea63d546c821db9b57990bfe58e2daf341c1c71e692ea556e0ed6ec3c052629d80d025b75596321916f1ad3ee5d60af8fe882

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 4884a1e84ecacbb3dee277fbcefc8b85
SHA1 6d80164e3820da5f1c37d70b60580c5343672869
SHA256 1c372bb74c60669e9db28171c94d4f4bf2bd3dcd82787e6d2cc0e4d066c0f5c4
SHA512 8eceb2e4d8536f1334876b04d62842a49f1ca1e572569bb72f5a2f5285d1326930c8e06988fcb4fc2dba842125258486d0080d280ff6ef38dd977eb2312d36db

C:\Config.Msi\e5b25a6.rbs

MD5 0009905b8e9924f4327bd25a58654f4f
SHA1 3de3d0a647b14c6bb7630d26a95b7639a234dedf
SHA256 5bb0531b069493e3c6807fecfdb1c7337f1c4edd59ae4d7a7d1471d28feb21d3
SHA512 414a30476ff1cd2b9382c7e487ade7f317d6de9f593e5c06619d154f89041bba650932c4681e925a15e03be4a55c37970dac105fc389d3327820dd416aec8d6c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fc7ec2556a70074d95327172a3e7d6e8
SHA1 ed6ed68262c5be2aa023b99f597cff4472123f00
SHA256 81714a539aa53a6b528c29d207936e0dbbb688541a89174bdff626a6cfdc12aa
SHA512 7694601cddca084827e4a77b91ee774b8167a80185ec92dce64403dda36d72c6b6a04ae9017bf1d701f93f5466397e7d386e0503e4c12f3c8f234bd892f22b2d

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\0d19ce75-bcdf-40e2-b996-f635323e457c.down_data

MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 96232f33005e4c585b7751a813f475c6
SHA1 7a934efcc9051d881018aa9e1410908e2f2fbd19
SHA256 cd9ab4f1d07c00ccf350da797acbd95a9eac0b2f0f9947bd5f72508424feaa31
SHA512 08dd8cbe6fdca387614a0c428ab0e726d9b8ccd904f8d46618328cbedac1df6294c8666dd6eaf66753b34a53201a4a4b5e66d287b811efb15bf57c64e46ced32

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 dfcc2fbbea92557d6e8782707b957c99
SHA1 c5640c0fc9d87b73aa98df863e21984c9d7747c3
SHA256 4c4669762374f008dd6b731ee99e0894fe7f194c3c32eccbecfa4211c256aa92
SHA512 477cc53040fae4301922e430955142b21caf43d4daaf0fb6f8dc6ccf579ee9f5dfa4323d9809f622dcae7cac2344b2e6466eaebbc5e15166666774ec0aa219ca

C:\Config.Msi\e5b265a.rbf

MD5 e0eb40842ca3a05b93e8fcf19f0bcc16
SHA1 01f14ac781463066de363e63039b6b5c80e7a2d2
SHA256 32decd776fc0020d399adcea54ff1b338110514e598a2788b4d9d7ea82582445
SHA512 3981e7c761ec81cb1b18e46b82355cb8b160028fca0f5b7159cd9fcab3824172cf496da57518ce9344351d49d576eea0e1d09b54e1d5fbf2da882ffa8061a7d9

C:\Config.Msi\e5b265c.rbf

MD5 5ab26ffd7b3c23a796138640b1737b48
SHA1 6dab8c3822a0cab5b621fd2b7f16aebb159bcb56
SHA256 eb775b0e8cc349032187c2329fefcf64f5feed4d148034c060e227adf6d38500
SHA512 2b40489f46e305f7e3455cac25e375711a6a1733861ee7bf1b800b86eaad2f40871c219924ddceb69b9748ae3cf9de59f0edffd7ed7b5e7f35d1239fe0333a78

C:\Config.Msi\e5b265e.rbf

MD5 8d46b86e8a60ae61796c6a95b4acbe5f
SHA1 f94fd98d504b4654b5dd8cbc244f755f07a4ec99
SHA256 6c5de0800ef7a46174ce4f6eb4703a4b69369e8652d43f9337fba72eafdf86b4
SHA512 25e4bacd553f2b1844f4a7fb63f17ebf739c4ab1a861f418c1066ec2244f0848695b31fa3a4d8da5aa7eee436045cc94da508b9494a2ffc086e9843b1e648613

C:\Config.Msi\e5b265d.rbf

MD5 c3af132ea025d289ab4841fc00bb74af
SHA1 0a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA256 56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512 707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

C:\Config.Msi\e5b265b.rbf

MD5 d36deceeb4c9645aab2ded86608d090b
SHA1 912f4658c4b046fbadd084912f9126cb1ae3737b
SHA256 018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45
SHA512 9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

C:\Config.Msi\e5b2659.rbf

MD5 1ffec2a95db8f1fa25d3b275261728b4
SHA1 123fbcc9e2e35b5782ae19bb18e8f8ebdb2fc29b
SHA256 dd9dbe58cd2f798b432d9ba9bbffe13d08bf9dc18c9b6a6ecf4ba71b238677e3
SHA512 4bd65e5edf3aa9bd6271b0abc17080bfdfca62e0ac1a927ccb01e358dc21c0f7ad3790c02fc2d2a07fb836ce8af471b035adafa12d4c703c2a1745f35fd1114a

C:\Config.Msi\e5b2658.rbf

MD5 fe522d8659618e3a50aafd8ac1518638
SHA1 7d1b392121da91393f69d124928f9fe50d62f785
SHA256 254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23
SHA512 fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81

C:\Config.Msi\e5b2657.rbf

MD5 bbf51226a8670475f283a2d57460d46c
SHA1 6388883ced0ce14ede20c7798338673ff8d6204a
SHA256 73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e
SHA512 f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9

C:\Config.Msi\e5b265f.rbf

MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

C:\Config.Msi\e5b25f4.rbs

MD5 24f85c50a4a98f41e66c6353a6ef68da
SHA1 0cce5895b360b42fbd8b41af6ea25e59c8ba71d4
SHA256 6627c01b548626121ee233dc7ffac4de70a7fcf3625903035d66466cf305d0dd
SHA512 a02beb4d724c3e5c3e279fee112ce4e573c774a15631c6374ec4bb7907db5aaab3955000bd6d6fa8ff54a303059d28d41436ec1816331d24fa382a1b60b24cdc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 503d980e3f6886e3167d8c3d274e6bd2
SHA1 b7533b93ad0d34be30b3c77ae813b4034ba65e09
SHA256 b6fe771d769e93ccd9c6d6fc01bdd023ef60c9da7976265965d2f819fc8e36ff
SHA512 686d14599ad56d32e43efdd39186d2313e536162a8907027aeaaad21eaa6741026f1bcf854e0db936e585557feb5835ae6f34c72b9f2dad37f2f56724be543ad

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 08047049bfd27b6dfc1abc837b9d076f
SHA1 ce1efab8ca72f4430fd5d76305f4cb06f7b091fc
SHA256 044d3fcb3c4998bde1f192d137ed210291598e5cfba21bafb8b1d29cda7d73fa
SHA512 772941e605db0cca70cc2748e47e5eb79130a9f819ce1539eb631493bebcdb435ff9bac9af43b9f94951ebf1d3936db6e3a4f6f348a243521af3b901fa6a54e9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

MD5 e5fc91cbce096df1d36191f9eedd3c64
SHA1 1a8076bf524b6d2b8a44c18fa8afb199a60dc1c9
SHA256 0e111dba5797ec182bf4af537a2c928ebd3957b99ed291610fbf322d6c2c9e19
SHA512 c9b064fbcb2df48dcf5bfa4387c164acb2bae075af013e6c39166dddc7e91ce993caaa0fdfac3ba1c3a12ca6c21577d99776fb1445f3009c7359b926a173f668

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

MD5 d4586933fabd5754ef925c6e940472f4
SHA1 a77f36a596ef86e1ad10444b2679e1531995b553
SHA256 6e1c3edffec71a01e11e30aa359952213ac2f297c5014f36027f308a18df75d2
SHA512 6ce33a8da7730035fb6b67ed59f32029c3a94b0a5d7dc5aa58c9583820bb01ef59dd55c1c142f392e02da86c8699b2294aff2d7c0e4c3a59fce5f792c749c5ce

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5 87c2b09a983584b04a63f3ff44064d64
SHA1 8796d5ef1ad1196309ef582cecef3ab95db27043
SHA256 d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
SHA512 df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

MD5 7c244372e149948244157e6586cc7f95
SHA1 a1b4448883c7242a9775cdf831f87343ec739be6
SHA256 06e6095a73968f93926a0a5f1e7af9d30ecca09c94c8933821ca0e45732161ed
SHA512 4ce4d73b785acde55a99f69ea808a56dec69df3bb44ac0d049c243fc85544db4c020412634da52a069b172e2484a6f2c36799e38adbfb988bcb5703fd45b3601

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

MD5 832ad40beba0d187ccda3633189c65e8
SHA1 e7dae2828eccde88d76a18af16c069a9e60779b1
SHA256 16324156d318738cd39d0c99fa3729559caf3b530111d9251cf4ddcf2f110194
SHA512 ca1f39b5c272be8be8420e37e4332b6ef59574f95983d5e1a1c102256a3478e2796dcfada5720da6ac0d0106d7faeadca6f3fbc2a98036bd10ac09031d997705

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 98b2dd76371866e9e3bb977469db9887
SHA1 e968e78eba01c1398caa6cd5cdabf4ba9565f3bc
SHA256 e52722e40fc8825213e754feb33c565fb44347f4bb9bcffc5d6e60e17c9dbbb7
SHA512 3ac109162c25854debe6d6d10cf81927c7e07265e15074c909197f8d3378900e2594abef5ca18f145c17b36d3ada1937c7829f300f577a1cf5632e72608a42a4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f55b3a91807e36a6295ea92850838f8c
SHA1 51a3497224ee8e89af2c925c90af3c928e5b953b
SHA256 683944ba15adbcea865ae7ac86b2520f7c3ad0937b772db7dc3701256963c6ed
SHA512 0058d85d1a2424b8ef2cee5bf678af56a83e1daa4de01aeb8a4d04609f60213234954523e5295e51ae9a0a90d010b9702b17be0de5d8f84ee6d241dd34ed16ea

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 19e1c05baace74dbcc37e65cc5d1712d
SHA1 52efdf8de5824fba526714fdd9d4eb83628654a7
SHA256 78ec558e1b1060f4ad151b006ca5baec4c48b9e32af8aea04335306a9ef9be68
SHA512 d771966e476890cda3473a84d910ec677b18b691609287a6625122dafcb87cee55b44216ec2e493c3f5e5be0368455e402cbc75a8ac21c88f7a6f5f05fce82e4

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 60b9c145a089b41980062bf6d456cc05
SHA1 be597d4d942c881bd6173d974fa55b7fbb851ac2
SHA256 fbe0f8061f70424dce98d7395eae236fdd09065d8f0ef52ae596e2d18e465de3
SHA512 02a95b8b74dcda7869538fec25d5a3508bfb7c60b8d2e30ccad3a10c2ae52366cce7f6f6afafb6786a958b32a7815d9d357d434a8a83d6239199bb57643c4f33

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8d5ced3e3be7afd2fce8fe98052a7131
SHA1 f745645dfef242ffcba02085be9475b717fc61c8
SHA256 eaf47bcc4ce5c6da4fc3c2116a6bee62b972cc5126ffdca498d39486c27880af
SHA512 f6def1d03a7911e12f461266439665cce0948b4c021250e5052b27bbc510e1f6fc0f09317f3693e57ed1f88c252b466e8b3d612b753dc13ed71dbf859490fc0f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f330efa22aa3f4b4e970e02406641681
SHA1 3018d69477e22d2d3b7c3b92933d56845a8ec456
SHA256 2e59f77bd173f1bd09e6d239d6003b8be690bba0fbc395e563b8d8e2ee4ff8b4
SHA512 38d10ac9329255d2eddf3f316ec6100aca17ac5d2f6ea244310473f9b474e3696f3daee3fe30cc7791274894f4fe37b945a8f45f1ca3849e817d1ecfd4efd894

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 14f91400e13ea298efea2974a698450a
SHA1 26a6e8740fb93bf10cb653711f22283df6afa79e
SHA256 9b21114d1085685fe9b8d1a99a7681beca86f14bee7cd5368f570c578949462b
SHA512 44ccffa4d4c5be21afa63596ac83dd57cdb9cb7d2cffe33b1a0c7375757fb9d4ff50e059ec810f84570c2008709f0c8a10769fee8f7ae695bce41c96f4c98bcb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1e1441ffc533243102d4e1d1fc471728
SHA1 7c4c968653276e6a919690396157a761c8ec300e
SHA256 166b93b3afb06e82cbabf38425c73aba4b65aefef39fc188ad8a52be18f9b74a
SHA512 943c57354fa3f9081c4c8bd5f8c503ed21235135867d8ad4317613f162667ac8b03c9c29c97306a926f1d13fa9547427daff55759e1d93345d8c6ac24eec9d75

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 153866273fd7379caa8c415fcdb161c5
SHA1 483f2f5e874ca4fd59bce62cf11ff731d2368f82
SHA256 6c2dff4d07ed6f38507df5ab5d26e78850ba4c6eb67ea938ea66d11e5a9f0f11
SHA512 e9b5cd134de85cf1f1e233a9044cd34d1404a3a9590a5d56627520d30bc4e989f8931b921bec59d9773c1813298fe0468eb8b94945288b34fa5ef4e02b066b1f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 125afc611e632d38785863ce3cb20887
SHA1 47c9362d7779b9a9ed67b4b9a1b8a8c6ebab291b
SHA256 9f574b6f35382fb09079591e008ff91c1e2e7a5569e8f57cb6c32714702eab02
SHA512 c4f874d87155358d29306b036f13c48e94e0e5c9cf08d75dec15d755f143c552910285a3053bdc584eb9f8912e86f47743e4e7c61077652ad90dbb292ecdd680

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b3165b9111db78daaa0511035abc382a
SHA1 3a348a6ea5c6b117f0bed725d52a17f478169859
SHA256 d7550d52c5cebcae0996da15ec4de43317765e43a433b1325a8eb419794a3dd3
SHA512 ba58f8778ad2f953154af4b93e748e019913fa2fd29735cf3320228bda86a150a8aa7bae9f97ec47da736c06918545663b7e5f03fe2dbf50a6fb01ccedda23e8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2ba64f60cca776f84ec4b75727973852
SHA1 841fd60af120c0c025ac767d6d7a8b34b46207ce
SHA256 070b485af4000ef1221c5b12e03527757a763f1ed3af4f7432441d6cf368a97d
SHA512 de29e1a3af1770d629513eff6471e998c62ca36b00b208ca5009ab7843de805daec8bc3ebc4af48417feb3f0860f5f99e488d4309b5bc93c6d78dff7626110bd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 2420b7ba9e1e87ca056b2579985c65c1
SHA1 68594793a5a8e4f6a9b1fd47b8246be8a2057c1d
SHA256 40ea34595eae5b365447ad2c3acdfb87471abafbbe6ec81f5cbf27fbeb3801b6
SHA512 b17aa3265a90ddf15ae5227f3f301aafaa7208929a4f552bf3838c5e2a96b60ef20b239bcc4f81f2916c1c771735d39900d22f6af50a6de4ff976d000d2ea436

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 10da028b4e6f3e551d7c59d0a4eae6b4
SHA1 62738c75d3e75c1b309f05676635762b4a4d8a49
SHA256 c874eca7b083adc6b5571da5002fb288539feb009d4f77e428b088d0509b361a
SHA512 0004822a5b9ceeb3b2569ea56c4d7db2fdeaf46e34a0267c926201a94b2d2a680c06970b023d9b7fb6eff251279aeb9744383eefd8c514d2bf66e2c97adaf761

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 991eba7732142c901b3ea4b5a1360d52
SHA1 7fb219796134ee4f89b92f7a52f658dad78574a2
SHA256 25d0f6761b706e49bd2e7865c37dc6a3978fd867a24027a64b2de780377c08a4
SHA512 de1eaefa91a7fb4cf7f30e3ea7a2223356046b05ac0ee45b48cebd4886e6ef205094bb8b7edbfeaebacf985b3b1e5ba9288d36f5fd13b0188710d0b333031337

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 2b8ee32caf2b6fc4c7aeee5d2f73917f
SHA1 b2419be5a3835f3df980604a61e76dc0b12dde49
SHA256 07810bb0dcad279d0efc284fc2fe50b014035915d1a96d35cc5c6fd1f4422075
SHA512 d438be3e044d8d7b466c0b449ab48570edf98fba01a98a6a67942a781f9be757c4a09847ba9c72ad8452100195560c8b76e15c06e3748cb4be5937df0dc97c52

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 11a7d6cdd9aebbfa87aadd388b80dcf5
SHA1 62ecf2559b76364f322a3b3a1d782cb9286bb064
SHA256 e92d58ed42bfb0bf6577dde869671465d27409d574fff81359d481f468d48924
SHA512 78781b6d0abc832c86ba7a9a42d7166e1d28967aa31805ac0f4483d1f7a2cd75b19527dceb6abd97099c06cb817c2ec33fb9504847d00a14958229a1b7b98737

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 15fe23f58fbace6fb9c26d497b619245
SHA1 a6db4757f568836fa495675f3ed3027c859bd0bd
SHA256 c53a3d26d2e6f4df13c98a7ebde671249c18542085f9160ae420a88e5d4c4915
SHA512 444af031a84c48e74cb3aafc24c39ab584362e827c9df1a68878f1be38aea80c468ce5f621cf55908b779423097650aa126e8fdcff3fa4798036a61f50bf1576

C:\Config.Msi\e5b2661.rbs

MD5 4a1f7b5393ed5806de73df26a55de62f
SHA1 f4f49807e02eefce09ef7006aab40f18a8b9aa08
SHA256 f8f512f6d4b1bfce7b18f0b8ed76e8825120637b70d3fcdce02ccaa59d2da4ee
SHA512 37d103f34b9ebac7e31fca18b9f563a4eb86637eb8fb6d76b4271d04e218ca25d39c9ce80abb88383cd30e692f75e5d36d599cbaaed5853f2834e22c5ebbf2ca

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ebe2adad19cf016db5fe5211e6e36225
SHA1 d335b0da78f8d9bc2f973edb0dd7e2fc0a3b8fd8
SHA256 169681e01731972b9ea91866d6750b7b12a2dc6c79cb200737e69c1db09cce42
SHA512 a382ea711cb5b01cabd7b8e541ad8526510d5c85e4f2677cd3fb4be9676e9b6399f5919ddae3ef5c3465ac4b4fb60b2b5155fde5ab6d7b3553ecd534aa3261c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 2b6b4ad4cab69dc79f5aa4bb537392f0
SHA1 8b2acf85db1e7199deaf41cee981648254239437
SHA256 3aa0335873ac0209aada062aeeb9ea088ecb67e7878ebe763861f0e1bc37e674
SHA512 aa11ee924e544c2fb35232298d96b9e30563ba60aa741060bb6a29f24245f9842201b806aec79f39491ab62ab8cea93803c1968a4779a9de6d40829609ae6584

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 20cd328154fe1afcef45ef8f6e623c9f
SHA1 146c30daa3d837a436a755da535616514ac43e9d
SHA256 461b937396ff87c6aaf1e2f016e53863d408cb749412be47991c2861f43aff76
SHA512 db83ee28deac78a0f0268060d448f0d11fe1edce06ff757634a8391420e699c1cbbc0e4ab3edc31762f544e1cd0333127798d83c159731d89f156ccc09229915

C:\Config.Msi\e5b2662.rbs

MD5 876fa5ba6305635b5a30cb235ecaab0d
SHA1 6c6f7bf272d9ffa99e6ffcc3b55b95cb364e4e9f
SHA256 07d966ca31f672dbe451b4745a1013c51f63a5ecf94f902aacd61fd8b3c96afa
SHA512 bc22591f9fd48c703a616c4363e4086b0069c1a34fa01d539943841622c2c5a4893379b045d5d6796471dd350637fc7f9e47d21f1d01ce78d5457982f27c53c8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 c097603e1b1b6fb944665284c27f231d
SHA1 f4051c8414e3830155df7c831fd8f15064cf17fa
SHA256 98746677a5fd2601f6aded600a029df185d5820768dccfd02a466c2e9939caac
SHA512 821fae124837a357f70ffe8b3da4a4b58b321e1f8a32ff5d4142f60d3005b6fd318ea5036dff23915310b46f6d8beda7a7c3bd2f2c31c17b859d4dd4d58016e3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fcd7aebee61a3e11b5fdf2278b63131e
SHA1 8a3d5f3594da3a1d17cba72a510754c436bfff6a
SHA256 20ff70574f2808b9d909522e06fc4a86d55629b0451ec9196ced97551144f86f
SHA512 7a08bda72c932f166296580f1076bccf86a69c98192913ed7ae632f8c31f140f8e8de9fa1471eb5a68376122e3ebce324fd270d293be936e1142bf70e855afb7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b15ce8c7acf1993f75f8f0a36acc61db
SHA1 16779f2a2fbef80e92bc00280b092c41612aae70
SHA256 ec15847a77609567cf11c0c363b98fa8422289e84c3fa2d41c0840aa3dc7c6db
SHA512 80edd9c011ef337c6b7ba6f1416f135dd3a8fa58c15e1cfe84e4da71e912d2153b60e061b372e7f26a53d8e9ebdcd0f5481a555f3b9d08e1e56ea3489c188123

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 60bb9d3d25b690414025e787d2d432a7
SHA1 55687cf03e8d23ef7625b0231b2817275577c2a3
SHA256 eba2c569e5906ef931f1a05e6fc1485eb4dfd3f25e54b3e0df4570c62628adc7
SHA512 ecc897743ff7892ff5f91ccaeb304687fdcd546538fd2a923c6c4565cd20e395decaa83919c9fc80c225f03269f8d1c511c16d4f2d1d54d63fc0692cd93a29d4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 fefefd1dc605ff04d63ab035d7a73bcb
SHA1 9a72c6ff5906436f62758b99c9cd1e4c7fa8a9b9
SHA256 d3dfe8edc6e1facbb80658ec6200bd444b74816538605759def5d9f1771ab846
SHA512 50a67a879d2f5493a40fe9b83625ca7f1a21dea05ef45a1ecf13ea222b81067d8de7c74f43ecbc138386e3ad6b7f61b682b77ff015b84d98d56bc652724b7b2b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 66b9cbf7e2ee3ef857c223579c0a6202
SHA1 09c3d1af7945679ac81562dc63fa7e762b68fda9
SHA256 7f45483ef845f759fd69560e7865434139dd812f20e34a7028ffbfb01f474f4e
SHA512 7bdb4f7b9bbd68bfc76453f3810daa240f82caaa6a37880b5ac735823176e5f40677ebd60737d005181c21b93a38373dee73550a7cf61b52cee5d41074feaaf0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e571754de57292054aa82f01757d7faa
SHA1 6dcb1037d2c0cfe08bf1c9e0220e8f90e521b7c4
SHA256 e22db72fec27a29cb67be82aa53d404719c11c7d1dfef727c15b835721c9ad70
SHA512 38e39996b7bfac0f3d13e1ac0b2cc7d981c0acecd4db0ce1a2c728aa4e865e56c6ceb2ce3886bb276147aea4fd0b7ac22f9430f10082785aa52463bc149ab3e7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e1886d7eac7cbe735ca7c21765d39403
SHA1 3dada502425595493d200a41e4c461758d10b6df
SHA256 76a64f5921f6c947ee3a14632455fdcac939b2f16964c3643d05eaabbe519829
SHA512 9ce0517be57098f37c7174a1bcee7bcb0522d56ad0ef599d9d3f98bbe404413d7ed474b0e32b009828d61f624de93f7e938bf8a3abeda2ba82af666abaf22a35

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ece07c2e93a86b8227a4a07d32cfda34
SHA1 7b87ed2549a2c3b340b0efd5d10e4703cd49825f
SHA256 6204f33c5d79dcf37a98db487e7f59e4f7bb72a52730f63b370daf56cb2315c5
SHA512 c08729985aa9251fad68101b16f725fc81fe4110e41a5531d79edf2a929f30660c7170967d714c12b1fd2420dbdfef025906d8388163916a34c39472706688fe

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 455e6bfe7279848ef4034a288afc610c
SHA1 649d3f3ce35b86f4c1cebaf62bfa5d60eb6ce24b
SHA256 86fad103fb4637a7aa07fee332061213a6c51ec7997f9b52682f776e7494ff84
SHA512 53c07e35a7034ec24841a43c76b7756a01e9da02f8d7914d3508bf54a9be8599f463a42cb2247b26b6baf374318f6c9e1c62e7f917c482fffc95544638b628a3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ae978dd75c07fa723c182f4916c920e4
SHA1 415f722b4644d897cd34b80815f7a5d5137c33e9
SHA256 9995b4595fbdedb64b2f6d8fa16c8bcd77537a148967ec648d9adfda78396fbe
SHA512 cbbd823f7e01d3979ca5145afe13dbd3acf2cdcbb148872304f46ea0e41492496c0fcafeaf50ace0b674df669bb9b4e2d09c0d5aa4c20f6401b4c4f64dde1d0e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 2cf7bdd417d22104121e01d9110fcdd0
SHA1 f70339e954ced0f380181d327f3d4e5daff3423d
SHA256 0628ca82609e8cae6dd8adbbcd29109688cad949fbafc752c21d9565c83f63ba
SHA512 27fe061d18561e3a95dcf2300968bc3fcc6582127fab52a973f2ef674da3068ba01e08fa990a90d7d8df3b9969a5e305e436bc09236a6dfa5e941f2e1af5373e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 dfa8db0cebad266319aa7d43ca65d77d
SHA1 24cbe1bb87b339057aa1bf22e9f4ba8785b5eb22
SHA256 34c102696c4b78a04ee3bb3c13669390860d8e5dfb78941126651f88e3bf58d4
SHA512 5201c99879395dbc730352c5266dcfab430b063ca85ffe335c1917969905ed9e8719798f75514c8861e8fd8d079778c09c98d5589ac533de85a3826bf2953af8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c41a058049762d62ffcf18f821060810
SHA1 254cfc70bc6132d3d0e703122148dafdffd15a60
SHA256 d74f5d50505f52299b1bfed0133e8f57493969b3ab69a62a480c082b38b86745
SHA512 578a705e6e77c6e6b4b569fc5f5ecc151839b504ee7656d3f6291ff34d1b90c86e55cb8274d332e85c3a38f400bd3f016b0eb93113049de8cd0862b99db4156b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0e05f226e235632be253903e624d8ad3
SHA1 68625ba772a5515f9bca5b9313e470b3f0333b27
SHA256 bd9c1897acf59e60b86b09c3432c7662277549cfddab10cf0ccedb164970b3f9
SHA512 f5404fbcf11cc3efdf3ae91c711d4d86f42b008b7f0059a4915520770449a98c9247e18163938f538bb9cb74f985a3a934f21880928bd0f6e8d132f2275682f5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0c193299913117db5529ceb38a261d48
SHA1 f38b9fa38dfa4eb996afb30a66ef10cc87d2c32a
SHA256 28f7d984031c1b3fcdfa97f1b27aa7a776ca9fb8164ef8e019ad2adc65721b38
SHA512 ae046ebf64e1e44b4d04b172ee6021a33075b3278f943760201d458d3c85a80e09c219150967d1e3683d103619d966cfdb63c2929e73110b545316272fbdf343

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 90e47b33cbd3dfc636834f546b0d54c5
SHA1 da258ae912eb81c4f9efd99f84bf5e377606db91
SHA256 d85d742c6242673b1683d7212b3875a7a224e427e00408ff4dc63fb197628c2b
SHA512 f659faa63b24dea93a7df0cf2229a09ba3dbaf827f3ba5d3b2da4871449d4c7561c957d6050c346deedb9df8085b94a64300974c4386047065b95740c99c2515

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ade04bdcae1eb7022ba9847a35829f14
SHA1 06156c6cbe806eb1ef55ceec8c0479d5f0f3f15d
SHA256 693bad0a17ce6185b507052b174c998c225df041cf3a82e9cb9fa8aad95a5509
SHA512 b1b40cd83de396b48aac4ae1a8b6e3abceea49b7e5d605c26f203c3cf4a73331d50f2e38f9c0c2c9088c3d876301787855937fa0ea913184fa5b0429525d5cc4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 92b10a3a24d96ea62a480a67b84ad961
SHA1 4cb594e4bb887d16e5cd548c641b288e54c1a0ab
SHA256 f8114d1892e0c90b3f990cbcea25178e7a239da57ec252d229ef27b37267b40a
SHA512 5370288dab143f3c65a2740a4fdb858b89e420bfd27e89d8bc42312a1bbb5c599d8c8d0992af77b36d85542f008b8b204304c64cd4b3cd94bb5914a6769f274c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 58af4ce98bafc6c29d3e826d8228e4f5
SHA1 bedc6370d58c2063bdb8bb67a4e9c4d9ec846326
SHA256 704697b6f4776b1517564b73b3c22f2baa25b7ae3e37d71f77b486796e618d7b
SHA512 26f3628764a26527fc349a3559b122812ea6a4ee2f1b966b796d2166616801878049e600b11a371990a79909f8b45bd8b1559547102cb6129edc661742349a01

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3bfb16996dfaf51eb1ccf1e108acd25b
SHA1 9ebfa33795b50034f5db3517e777105921ea82d7
SHA256 f273952e8e39316b6a11a3b77fc2c71daf0e227ce4a7122301096a57d49f99eb
SHA512 fa3f1b8f7b4f3efbdc73ac87af54ea9098330dcb613ee48283893b0851941f2669a658e165ab6060243dcb0e0593facdf0a8cd4caa8160ef28138efe5a651711