Windows Analysis Report
Wasabi.msi

Compliance

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jawt.lib			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.DispatchProxy.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\ktab.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.naming.rmi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.naming.rmi\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-string-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Transactions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Numerics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security\public_suffix_list.dat			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-handle-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler.management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler.management\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.FileSystem.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.TypeConverter.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.rmi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.rmi\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.VisualC.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql.rowset			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql.rowset\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Numerics.Vectors.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Console.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Drawing.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Splat.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.sasl			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.sasl\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Resources.ResourceManager.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.AccessControl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Http.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\netstandard.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Fonts.Inter.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jfr			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jfr\profile.jfc			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.net			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.net\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jfr			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jfr\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.Xml.Linq.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.unsupported			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.unsupported\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\e_sqlite3.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.FileProviders.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\javaw.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\clretwrc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.ReactiveUI.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\net.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.JavaScript.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.HttpListener.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\rmiregistry.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.Serialization.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Web.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Reactive.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.Linq.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\createdump.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jdwp.agent			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jdwp.agent\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebProxy.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\README.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscorlib.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Metal.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encoding.CodePages.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\j2gss.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscordbi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\.gitattributes			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal\Assets			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal\Assets\LegalDocumentsWw1.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Security.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.scripting			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.scripting\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\j2pcsc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.EventBasedAsync.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.pdb			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor\Geoip			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor\Geoip\geoip6			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto\santuario.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Json.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Emit.ILGeneration.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.sasl\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.charsets			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.charsets\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebSockets.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\management\management.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.TextWriterTraceListener.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\windowsaccessbridge-64.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Configuration.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\tzmappings			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\management\jmxremote.password.template			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Resources.Writer.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\limited			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\limited\default_US_export.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\msquic.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.jfr			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.jfr\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Win32.Registry.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SkiaSharp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.FreeDesktop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.smartcardio			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.smartcardio\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Numerics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\zip.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jimage.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\psfont.properties.ja			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-conio-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\tzdb.dat			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Data.DataSetExtensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\awt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql.rowset\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.net.http			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.net.http\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.DragAndDrop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Globalization.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.Xml.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ServiceProcess.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\java.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WindowsBase.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal\Assets\LegalDocumentsWw2.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.Expressions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.naming			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.naming\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security\cacerts			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.jgss			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.jgss\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jfr\default.jfc			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\libpng.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactivity.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\NBitcoin.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.net.http\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\management_ext.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.XPath.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\xalan.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Controls.TreeDataGrid.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reactive.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jawt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.Parallel.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.ConfigurationExtensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.IsolatedStorage.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\MicroCom.Runtime.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jabswitch.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Draggable.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.RuntimeInformation.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\icu.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.X509Certificates.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.Annotations.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\dom.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.net\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.ci			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.ci\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.CSharp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\zlib.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\nio.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Base.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Timer.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jfr.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.httpserver			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.httpserver\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-process-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\fontmanager.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Principal.Windows.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Skia.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.TraceSource.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.Binder.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Web.HttpUtility.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Pipes.AccessControl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebHeaderCollection.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SQLitePCLRaw.provider.e_sqlite3.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.DriveInfo.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.Tools.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.ZipFile.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\unlimited			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\unlimited\default_local.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-math-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.ReaderWriter.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SQLitePCLRaw.batteries_v2.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.jgss			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.jgss\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.accessibility			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.accessibility\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\prefs.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\msvcp140.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.CoreLib.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\DynamicData.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ServiceModel.Web.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Transactions.Local.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Collections.Immutable.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\management.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.Uri.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Collections.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Intrinsics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor\Geoip\geoip			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.TypeExtensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.DesignerSupport.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\rmi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Memory.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\unicode.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\asm.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SQLitePCLRaw.core.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Controls.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-time-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\aes.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\colorimaging.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.AccessControl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Win32.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.NameResolution.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.xml.dom			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.xml.dom\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\freetype.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.OpenGL.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.instrument			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.instrument\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.DiaSymReader.Native.amd64.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.agent			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.agent\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.runtimeconfig.json			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encoding.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.Queryable.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-private-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\lcms.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebClient.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.jfr\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\dt_socket.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Desktop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.rmi\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.ec			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.ec\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-debug-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-localization-l1-2-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\psfontj2d.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.Brotli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.transaction.xa			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.transaction.xa\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\logging.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.charsets\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-2-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\sunec.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\pkcs11wrapper.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Core.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Win32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.Desktop.deps.json			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Http.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Tasks.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.MemoryMappedFiles.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Handles.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security\default.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.ThreadPool.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\w2k_lsa_auth.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata\cldr.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Sockets.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\unlimited\default_US_export.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\clrgc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscorrc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\hostfxr.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\tor.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-datetime-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Formats.Tar.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\bcel.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Loader.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\keytool.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jrt-fs.jar			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Collections.Concurrent.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Ping.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\hwi.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\fontconfig.properties.src			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Pipes.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\ucrtbase.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Newtonsoft.Json.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Metadata.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jvm.cfg			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.DiagnosticSource.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.Native.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.smartcardio\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.DataContractSerialization.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Emit.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Emit.Lightweight.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\jcup.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jaas.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.AspNetCore.WebUtilities.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\modules			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.zipfs			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.zipfs\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\QRackers.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ObjectModel.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.agent\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-profile-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\av_libglesv2.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tmds.DBus.Protocol.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\javajpeg.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.OpenSsl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jsound.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.httpserver\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Native.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\public_suffix.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Resources.Reader.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.transaction.xa\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.Process.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jaccesswalker.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.UnmanagedMemoryStream.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\verify.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\fontconfig.bfc			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\java.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Tasks.Dataflow.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.prefs			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.prefs\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.compiler			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.compiler\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encodings.Web.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.VisualBasic.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Markup.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\xerces.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Pipelines.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Csp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\hostpolicy.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jlig.jar			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\vcruntime140.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-util-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Algorithms.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.sctp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.sctp\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Requests.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.datatransfer			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.datatransfer\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.Desktop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.zipfs\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Markup.Xaml.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.MicroCom.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.ec\ecc.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.Unsafe.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.instrument\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Quic.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Buffers.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscordaccore_amd64_amd64_8.0.324.11423.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\mesa3d.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\mlib_image.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.AppContext.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WabiSabi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.XPath.XDocument.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Globalization.Calendars.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-locale-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Drawing.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-memory-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Data.Sqlite.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.scripting\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.XDocument.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\c-libutl.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.jgss\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\opengl.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Themes.Fluent.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.auth			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.auth\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.naming\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-timezone-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Custom.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\java.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.dynalink			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.dynalink\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-synch-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Globalization.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.se			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.se\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.dynalink\dynalink.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebSockets.Client.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\bitcoind.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Formats.Asn1.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.Watcher.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\release			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\giflib.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\klist.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\server			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\server\jvm.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Windows.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\rmid.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Thread.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Mail.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l2-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-string-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\instrument.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.Debug.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.pdb			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\harfbuzz.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.NetworkInformation.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jsobject			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jsobject\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Dynamic.Runtime.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.ci\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-heap-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Formatters.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.sctp\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\classlist			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Channels.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encoding.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-utility-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\wassabee.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Json.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.logging			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.logging\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jaccessinspector.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.naming.rmi\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\libHarfBuzzSharp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Principal.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.xml.dom\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management.rmi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management.rmi\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Dialogs.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jdwp.agent\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\net.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.Abstractions.dll			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\WasabiWallet\jre\conf\security\policy\README.txt

Jump to behavior

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aipackagechainer.pdb source: Wasabi.msi
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: System.Text.Json.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdbSHA256i source: System.Diagnostics.Debug.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdb source: System.Xml.XmlSerializer.dll.2.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.2.dr
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: System.ComponentModel.Primitives.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.AccessControl\Release\net8.0-windows\System.Security.AccessControl.pdb source: System.Security.AccessControl.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.TypeExtensions\Release\net8.0\System.Reflection.TypeExtensions.pdb source: System.Reflection.TypeExtensions.dll.2.dr
Source:	Binary string: /_/artifacts/obj/mscorlib/Release/net8.0-windows/mscorlib.pdb source: mscorlib.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Cng/Release/net8.0-windows/System.Security.Cryptography.Cng.pdb source: System.Security.Cryptography.Cng.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Options/Release/net8.0/Microsoft.Extensions.Options.pdbSHA256 source: Microsoft.Extensions.Options.dll.2.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Serialization.Json\Release\net8.0\System.Runtime.Serialization.Json.pdb source: System.Runtime.Serialization.Json.dll.2.dr
Source:	Binary string: libGLESv2.dll.pdb source: av_libglesv2.dll.2.dr
Source:	Binary string: Avalonia.Xaml.Interactions.Responsive.pdb source: Avalonia.Xaml.Interactions.Responsive.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.SecureString/Release/net8.0-windows/System.Security.SecureString.pdbSHA256&JU source: System.Security.SecureString.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\native\java.base\java_objs\java.pdb source: java.exe.2.dr
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: System.Security.Principal.Windows.dll.2.dr
Source:	Binary string: /_/artifacts/obj/mscorlib/Release/net8.0-windows/mscorlib.pdbSHA256 source: mscorlib.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: mscordaccore.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdbSHA256 source: System.Xml.XmlSerializer.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.OpenSsl/Release/net8.0-windows/System.Security.Cryptography.OpenSsl.pdb source: System.Security.Cryptography.OpenSsl.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdbSHA256 source: System.Xml.XmlDocument.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256j source: System.Data.DataSetExtensions.dll.2.dr
Source:	Binary string: System.Text.Json.ni.pdb source: System.Text.Json.dll.2.dr
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: vcruntime140.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: System.Diagnostics.Debug.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb source: mscorrc.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: Microsoft.Win32.Primitives.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\Release\net8.0\System.Reflection.Primitives.pdb source: System.Reflection.Primitives.dll.2.dr
Source:	Binary string: WalletWasabi.Fluent.Desktop\obj\Release\net8.0\win-x64\WalletWasabi.Fluent.Desktop.pdb source: WalletWasabi.Fluent.Desktop.dll.2.dr
Source:	Binary string: System.Private.DataContractSerialization.ni.pdb source: System.Private.DataContractSerialization.dll.2.dr
Source:	Binary string: D:\a\1\s\externals\skia\out\windows\x64\libSkiaSharp.pdb source: libSkiaSharp.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Options/Release/net8.0/Microsoft.Extensions.Options.pdb source: Microsoft.Extensions.Options.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\jdk.security.auth\jaas.pdb source: jaas.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdbSHA256l source: Microsoft.Win32.Primitives.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.SecureString/Release/net8.0-windows/System.Security.SecureString.pdb source: System.Security.SecureString.dll.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: Wasabi.msi, MSIB640.tmp.0.dr, MSIB514.tmp.0.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.OpenSsl/Release/net8.0-windows/System.Security.Cryptography.OpenSsl.pdbSHA256 source: System.Security.Cryptography.OpenSsl.dll.2.dr
Source:	Binary string: vcruntime140.amd64.pdb source: vcruntime140.dll.2.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.2.dr
Source:	Binary string: System.Net.WebSockets.Client.ni.pdb source: System.Net.WebSockets.Client.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebSockets.Client\Release\net8.0\System.Net.WebSockets.Client.pdb source: System.Net.WebSockets.Client.dll.2.dr
Source:	Binary string: WalletWasabi.Fluent.Desktop\obj\Release\net8.0\win-x64\WalletWasabi.Fluent.Desktop.pdbSHA256 source: WalletWasabi.Fluent.Desktop.dll.2.dr
Source:	Binary string: System.Reflection.TypeExtensions.ni.pdb source: System.Reflection.TypeExtensions.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Private.DataContractSerialization/Release/net8.0/System.Private.DataContractSerialization.pdb source: System.Private.DataContractSerialization.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net8.0/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: Microsoft.Extensions.Logging.Abstractions.dll.2.dr
Source:	Binary string: System.Security.Claims.ni.pdb source: System.Security.Claims.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net8.0/Microsoft.Extensions.Logging.Abstractions.pdb source: Microsoft.Extensions.Logging.Abstractions.dll.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: Wasabi.msi
Source:	Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdb source: System.Xml.XmlDocument.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdb source: System.IO.UnmanagedMemoryStream.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Cng/Release/net8.0-windows/System.Security.Cryptography.Cng.pdbSHA256 source: System.Security.Cryptography.Cng.dll.2.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Serialization.Json\Release\net8.0\System.Runtime.Serialization.Json.pdbSHA256 source: System.Runtime.Serialization.Json.dll.2.dr
Source:	Binary string: System.Security.AccessControl.ni.pdb source: System.Security.AccessControl.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: System.ComponentModel.Primitives.dll.2.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.2.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: System.Data.DataSetExtensions.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.ValueTuple/Release/net8.0-windows/System.ValueTuple.pdbSHA256% source: System.ValueTuple.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: System.Security.Claims.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\java.base\zip.pdb(( source: zip.dll.2.dr
Source:	Binary string: Avalonia.Xaml.Interactions.Responsive.pdbSHA256 source: Avalonia.Xaml.Interactions.Responsive.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\Release\net8.0\System.Reflection.Primitives.pdbSHA256 source: System.Reflection.Primitives.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdbSHA256 source: System.IO.UnmanagedMemoryStream.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.ValueTuple/Release/net8.0-windows/System.ValueTuple.pdb source: System.ValueTuple.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\java.base\zip.pdb source: zip.dll.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: Wasabi.msi
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: System.Security.Principal.Windows.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\jdk.accessibility\javaaccessbridge.pdb source: javaaccessbridge.dll.2.dr

Spreading

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:			Jump to behavior

Networking

Source: Yara match	File source: C:\Program Files\WasabiWallet\System.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\WasabiWallet\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\WasabiWallet\System.Net.dll, type: DROPPED

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://anglebug.com/1452
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://anglebug.com/1452Bug
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://anglebug.com/2152
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://anglebug.com/2152On
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://anglebug.com/3246
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://anglebug.com/3246On
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://crbug.com/398694
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://crbug.com/398694Always
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://crbug.com/941620
Source: av_libglesv2.dll.2.dr	String found in binary or memory: http://crbug.com/941620Some
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://s.symcd.com06
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://s2.symcb.com0
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: WalletWasabi.Fluent.Desktop.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Avalonia.Markup.Xaml.PortableXaml
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.IO
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Runtime.Serialization
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Xml
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Xml.Linq
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/SystemV
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/SystemY
Source: System.Private.DataContractSerialization.dll.2.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/dhttp://schemas.datacontract.org/2004/07/System.XmlRhttp://w
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: System.Security.Principal.Windows.dll.2.dr, System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: System.Security.Principal.Windows.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: System.Security.Claims.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamevhttp://schemas.xmlsoap.o
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://sv.symcd.com0&
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: libSkiaSharp.dll.2.dr	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: bcel.md.2.dr	String found in binary or memory: http://www.apache.org/).
Source: bcel.md.2.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: bcel.md.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: libSkiaSharp.dll.2.dr	String found in binary or memory: http://www.color.org
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: System.Security.AccessControl.dll.2.dr, System.Text.Json.dll.2.dr, System.Security.Principal.Windows.dll.2.dr, System.ComponentModel.Primitives.dll.2.dr, System.Security.Claims.dll.2.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: av_libglesv2.dll.2.dr	String found in binary or memory: https://crbug.com/593024
Source: av_libglesv2.dll.2.dr	String found in binary or memory: https://crbug.com/593024Copying
Source: av_libglesv2.dll.2.dr	String found in binary or memory: https://crbug.com/650547
Source: av_libglesv2.dll.2.dr	String found in binary or memory: https://crbug.com/650547Using
Source: av_libglesv2.dll.2.dr	String found in binary or memory: https://crbug.com/655534
Source: av_libglesv2.dll.2.dr	String found in binary or memory: https://crbug.com/655534Using
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: jaas.dll.2.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: zip.dll.2.dr, javaaccessbridge.dll.2.dr, java.exe.2.dr, jaas.dll.2.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: Avalonia.Xaml.Interactions.Responsive.dll.2.dr	String found in binary or memory: https://github.com/AvaloniaUI/Avalonia.Xaml.Behaviors
Source: Avalonia.Xaml.Interactions.Responsive.dll.2.dr	String found in binary or memory: https://github.com/avaloniaui%Avalonia.Xaml.Interactions.Responsive
Source: Avalonia.Xaml.Interactions.Responsive.dll.2.dr	String found in binary or memory: https://github.com/avaloniaui%Avalonia.Xaml.Interactions.Responsive=
Source: System.Security.Cryptography.OpenSsl.dll.2.dr, System.Security.AccessControl.dll.2.dr, System.Data.DataSetExtensions.dll.2.dr, System.Reflection.Primitives.dll.2.dr, System.Xml.XmlSerializer.dll.2.dr, System.Runtime.Serialization.Json.dll.2.dr, Microsoft.Extensions.Logging.Abstractions.dll.2.dr, System.IO.UnmanagedMemoryStream.dll.2.dr, System.Reflection.TypeExtensions.dll.2.dr, System.Text.Json.dll.2.dr, System.Security.Principal.Windows.dll.2.dr, System.Private.DataContractSerialization.dll.2.dr, System.Security.SecureString.dll.2.dr, mscorlib.dll.2.dr, System.Xml.XmlDocument.dll.2.dr, Microsoft.Win32.Primitives.dll.2.dr, System.Diagnostics.Debug.dll.2.dr, System.ValueTuple.dll.2.dr, System.Security.Cryptography.Cng.dll.2.dr, System.Net.WebSockets.Client.dll.2.dr, Microsoft.Extensions.Options.dll.2.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: System.IO.UnmanagedMemoryStream.dll.2.dr	String found in binary or memory: https://github.com/dotnet/runtimep
Source: Microsoft.Extensions.Options.dll.2.dr	String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: WalletWasabi.Fluent.Desktop.dll.2.dr	String found in binary or memory: https://github.com/zkSNACKs/WalletWasabi/
Source: WalletWasabi.Fluent.Desktop.dll.2.dr	String found in binary or memory: https://tselka.org/files/jlig.jar=The

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\System32\msiexec.exe	File dropped: C:\Program Files\WasabiWallet\Legal\Assets\LegalDocumentsWw1.txt -> encrypted secret keys. if you use our services to create a wallet, the software will use an algorithm to generate random recovery words and optionally combines it with an additional word (called the passphrase as defined in bip39), where wasabi may use your chosen wallet password as the default passphrase. we call the combination of the recovery words and the passphrase as wallet backup, or backup. the service provider expressly declares that it does not store, have access to, or have any way or means of recovering your backup. it is your responsibility to keep your wallet backups, your wallet files, and your passwords secure. you should not provide this information to anyone, including any service provider representative. encrypted private key information is stored locally on your computer in a wallet file. private keys can be accessed with the password, which you created at the generation of the wallet. if you permanently forget or lose your backup, you will never be able to recover any bitcoi			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File dropped: C:\Program Files\WasabiWallet\Legal\Assets\LegalDocumentsWw2.txt -> encrypted secret keys. if you use our services to create a wallet, the software will use an algorithm to generate random recovery words and optionally combines it with an additional word (called the passphrase as defined in bip39), where wasabi may use your chosen wallet password as the default passphrase. we call the combination of the recovery words and the passphrase as wallet backup, or backup. the service provider expressly declares that it does not store, have access to, or have any way or means of recovering your backup. it is your responsibility to keep your wallet backups, your wallet files, and your passwords secure. you should not provide this information to anyone, including any service provider representative. encrypted private key information is stored locally on your computer in a wallet file. private keys can be accessed with the password, which you created at the generation of the wallet. if you permanently forget or lose your backup, you will never be able to recover any bitcoi			Jump to dropped file

System Summary

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c201b.msi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2163.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21C2.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21E2.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2231.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{FD1DF55A-A524-448D-9669-E90738865A64}			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2290.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c201d.msi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{7E27347D-8384-46CE-902E-1A7B1BB18ADF}			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4BE3.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{7E27347D-8384-46CE-902E-1A7B1BB18ADF}			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{7E27347D-8384-46CE-902E-1A7B1BB18ADF}\icon.ico			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c201f.msi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c201f.msi			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI2163.tmp

Jump to behavior

Source: Microsoft.Extensions.Caching.Abstractions.dll.2.dr

Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary

Source: WabiSabi.dll.2.dr	Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"
Source: Microsoft.Extensions.Caching.Abstractions.dll.2.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary

Source: api-ms-win-crt-convert-l1-1-0.dll.2.dr	Static PE information: No import functions for PE file found
Source: System.Xml.XPath.XDocument.dll.2.dr	Static PE information: No import functions for PE file found
Source: System.Collections.NonGeneric.dll.2.dr	Static PE information: No import functions for PE file found
Source: System.Data.Common.dll.2.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.2.dr	Static PE information: No import functions for PE file found
Source: System.Drawing.Primitives.dll.2.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.2.dr	Static PE information: No import functions for PE file found
Source: System.Diagnostics.FileVersionInfo.dll.2.dr	Static PE information: No import functions for PE file found
Source: Microsoft.VisualBasic.Core.dll.2.dr	Static PE information: No import functions for PE file found
Source: WalletWasabi.Fluent.dll.2.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.2.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.2.dr	Static PE information: No import functions for PE file found

Source: Wasabi.msi	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs Wasabi.msi
Source: Wasabi.msi	Binary or memory string: OriginalFileNameaipackagechainer.exe vs Wasabi.msi
Source: Wasabi.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs Wasabi.msi
Source: Wasabi.msi	Binary or memory string: OriginalFilenamePrereq.dllF vs Wasabi.msi

Source: classification engine

Classification label: sus26.rans.troj.winMSI@8/577@0/1

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\ZKsnacks

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\Public\Desktop\Wasabi Wallet.lnk

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user~1\AppData\Local\Temp\MSIB3F8.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Wasabi.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 8954D0F09732CC8C32EC25B7D9AA876D C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E9EF6AB8F4B248236972964FA7D85355
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ZKsnacks\Wasabi Wallet\prerequisites\Wasabi\Wasabi.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 8954D0F09732CC8C32EC25B7D9AA876D C			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E9EF6AB8F4B248236972964FA7D85355			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ZKsnacks\Wasabi Wallet\prerequisites\Wasabi\Wasabi.msi"			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Automated click: Install
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jawt.lib			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.DispatchProxy.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\ktab.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.naming.rmi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.naming.rmi\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-string-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Transactions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Numerics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security\public_suffix_list.dat			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-handle-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler.management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler.management\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.FileSystem.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.TypeConverter.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.rmi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.rmi\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.VisualC.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql.rowset			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql.rowset\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Numerics.Vectors.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Console.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Drawing.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Splat.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.sasl			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.sasl\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Resources.ResourceManager.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.AccessControl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Http.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\netstandard.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Fonts.Inter.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jfr			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jfr\profile.jfc			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.net			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.net\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jfr			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jfr\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.Xml.Linq.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.unsupported			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.unsupported\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\e_sqlite3.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.FileProviders.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\javaw.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\clretwrc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.ReactiveUI.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\net.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.JavaScript.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.HttpListener.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\rmiregistry.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.Serialization.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Web.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Reactive.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.Linq.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\createdump.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jdwp.agent			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jdwp.agent\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebProxy.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\README.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscorlib.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Metal.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encoding.CodePages.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\j2gss.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscordbi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\.gitattributes			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal\Assets			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal\Assets\LegalDocumentsWw1.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Security.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.scripting			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.scripting\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\j2pcsc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.EventBasedAsync.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.pdb			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor\Geoip			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor\Geoip\geoip6			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto\santuario.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Json.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Emit.ILGeneration.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.sasl\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.charsets			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.charsets\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebSockets.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\management\management.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.TextWriterTraceListener.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\windowsaccessbridge-64.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Configuration.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\tzmappings			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\management\jmxremote.password.template			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Resources.Writer.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\limited			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\limited\default_US_export.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\msquic.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.jfr			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.jfr\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Win32.Registry.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SkiaSharp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.FreeDesktop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.smartcardio			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.smartcardio\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Numerics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\zip.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jimage.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\psfont.properties.ja			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-conio-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\tzdb.dat			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Data.DataSetExtensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\awt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql.rowset\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.net.http			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.net.http\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.DragAndDrop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Globalization.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.Xml.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ServiceProcess.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\java.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WindowsBase.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Legal\Assets\LegalDocumentsWw2.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.Expressions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.naming			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.naming\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security\cacerts			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.jgss			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.jgss\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jfr\default.jfc			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\libpng.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactivity.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\NBitcoin.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.net.http\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\management_ext.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.XPath.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\xalan.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Controls.TreeDataGrid.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reactive.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jawt.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.Parallel.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.ConfigurationExtensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.IsolatedStorage.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\MicroCom.Runtime.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jabswitch.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Draggable.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.RuntimeInformation.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\icu.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.X509Certificates.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.Annotations.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\dom.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.net\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.ci			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.ci\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.CSharp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\zlib.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\nio.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Base.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Timer.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jfr.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.httpserver			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.httpserver\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-process-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\fontmanager.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Principal.Windows.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Skia.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.TraceSource.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.Binder.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Web.HttpUtility.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Pipes.AccessControl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebHeaderCollection.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SQLitePCLRaw.provider.e_sqlite3.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.DriveInfo.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.Tools.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.ZipFile.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\unlimited			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\unlimited\default_local.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-math-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.ReaderWriter.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SQLitePCLRaw.batteries_v2.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.jgss			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.security.jgss\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.accessibility			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.accessibility\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\prefs.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\msvcp140.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.CoreLib.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\DynamicData.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ServiceModel.Web.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Transactions.Local.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Collections.Immutable.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\management.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.Uri.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Collections.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Intrinsics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tor\Geoip\geoip			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.TypeExtensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.DesignerSupport.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\rmi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Memory.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\unicode.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\asm.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\SQLitePCLRaw.core.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Controls.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-time-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\aes.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\colorimaging.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.AccessControl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Win32.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.NameResolution.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.xml.dom			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.xml.dom\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\freetype.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.OpenGL.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.instrument			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.instrument\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.DiaSymReader.Native.amd64.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.agent			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.agent\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.runtimeconfig.json			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encoding.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Linq.Queryable.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-private-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\lcms.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebClient.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.jfr\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\dt_socket.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Desktop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.rmi\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.ec			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.ec\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-debug-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-localization-l1-2-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\psfontj2d.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.Brotli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.transaction.xa			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.transaction.xa\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\logging.properties			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.charsets\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-2-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\sunec.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\pkcs11wrapper.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Core.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Win32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.Desktop.deps.json			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Http.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Tasks.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.MemoryMappedFiles.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Handles.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\security\default.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ComponentModel.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.ThreadPool.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\w2k_lsa_auth.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata\cldr.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Sockets.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\policy\unlimited\default_US_export.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\clrgc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscorrc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\hostfxr.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\tor.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-datetime-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Formats.Tar.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\bcel.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Loader.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\keytool.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jrt-fs.jar			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Collections.Concurrent.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Ping.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\hwi.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\fontconfig.properties.src			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Pipes.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\ucrtbase.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Newtonsoft.Json.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Metadata.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\jvm.cfg			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.DiagnosticSource.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Compression.Native.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.smartcardio\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Private.DataContractSerialization.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Emit.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Emit.Lightweight.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\jcup.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jaas.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.AspNetCore.WebUtilities.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\modules			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.zipfs			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.zipfs\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\QRackers.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.ObjectModel.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management.agent\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-profile-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\av_libglesv2.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml.crypto\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Tmds.DBus.Protocol.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\javajpeg.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.OpenSsl.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jsound.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.httpserver\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Native.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\public_suffix.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Resources.Reader.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.transaction.xa\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.Process.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jaccesswalker.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.UnmanagedMemoryStream.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\verify.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\fontconfig.bfc			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\java.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Tasks.Dataflow.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.prefs			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.prefs\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.compiler			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.compiler\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encodings.Web.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.VisualBasic.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Markup.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.xml\xerces.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.Pipelines.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Csp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\hostpolicy.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.localedata\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jlig.jar			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\vcruntime140.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-util-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.sql\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Algorithms.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.sctp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.sctp\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Requests.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.datatransfer			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.datatransfer\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.Desktop.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.zipfs\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Markup.Xaml.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.MicroCom.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.ec\ecc.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.Unsafe.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.instrument\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Quic.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Buffers.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jli.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\mscordaccore_amd64_amd64_8.0.324.11423.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\mesa3d.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\mlib_image.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.AppContext.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WabiSabi.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.XPath.XDocument.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Globalization.Calendars.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Abstractions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-locale-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Drawing.Primitives.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-memory-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Data.Sqlite.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.scripting\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Xml.XDocument.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.base\c-libutl.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.jgss\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\opengl.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Themes.Fluent.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.management\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.auth			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.security.auth\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.naming\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-timezone-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Custom.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\conf\security\java.policy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.dynalink			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.dynalink\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-synch-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Globalization.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.se			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.se\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.dynalink\dynalink.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.WebSockets.Client.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\bitcoind.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Formats.Asn1.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Reflection.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.IO.FileSystem.Watcher.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\release			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\giflib.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\klist.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\server			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\server\jvm.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Windows.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\rmid.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Thread.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.Mail.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l2-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-string-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\instrument.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Diagnostics.Debug.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.pdb			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.desktop\harfbuzz.md			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Net.NetworkInformation.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jsobject			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jsobject\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Dynamic.Runtime.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.compiler\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.internal.vm.ci\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-heap-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.crypto.cryptoki\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Formatters.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.sctp\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\lib\classlist			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Threading.Channels.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Text.Encoding.Extensions.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-utility-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\wassabee.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Json.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.logging			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.logging\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\jaccessinspector.exe			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.naming.rmi\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\libHarfBuzzSharp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\System.Security.Principal.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.xml.dom\LICENSE			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management.rmi			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\java.management.rmi\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.Dialogs.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\legal\jdk.jdwp.agent\COPYRIGHT			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\jre\bin\net.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Avalonia.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.Abstractions.dll			Jump to behavior

Source: Wasabi.msi

Static file information: File size 3083264 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aipackagechainer.pdb source: Wasabi.msi
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: System.Text.Json.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdbSHA256i source: System.Diagnostics.Debug.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdb source: System.Xml.XmlSerializer.dll.2.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.2.dr
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: System.ComponentModel.Primitives.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.AccessControl\Release\net8.0-windows\System.Security.AccessControl.pdb source: System.Security.AccessControl.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.TypeExtensions\Release\net8.0\System.Reflection.TypeExtensions.pdb source: System.Reflection.TypeExtensions.dll.2.dr
Source:	Binary string: /_/artifacts/obj/mscorlib/Release/net8.0-windows/mscorlib.pdb source: mscorlib.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Cng/Release/net8.0-windows/System.Security.Cryptography.Cng.pdb source: System.Security.Cryptography.Cng.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Options/Release/net8.0/Microsoft.Extensions.Options.pdbSHA256 source: Microsoft.Extensions.Options.dll.2.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Serialization.Json\Release\net8.0\System.Runtime.Serialization.Json.pdb source: System.Runtime.Serialization.Json.dll.2.dr
Source:	Binary string: libGLESv2.dll.pdb source: av_libglesv2.dll.2.dr
Source:	Binary string: Avalonia.Xaml.Interactions.Responsive.pdb source: Avalonia.Xaml.Interactions.Responsive.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.SecureString/Release/net8.0-windows/System.Security.SecureString.pdbSHA256&JU source: System.Security.SecureString.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\native\java.base\java_objs\java.pdb source: java.exe.2.dr
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: System.Security.Principal.Windows.dll.2.dr
Source:	Binary string: /_/artifacts/obj/mscorlib/Release/net8.0-windows/mscorlib.pdbSHA256 source: mscorlib.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: mscordaccore.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdbSHA256 source: System.Xml.XmlSerializer.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.OpenSsl/Release/net8.0-windows/System.Security.Cryptography.OpenSsl.pdb source: System.Security.Cryptography.OpenSsl.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdbSHA256 source: System.Xml.XmlDocument.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256j source: System.Data.DataSetExtensions.dll.2.dr
Source:	Binary string: System.Text.Json.ni.pdb source: System.Text.Json.dll.2.dr
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: vcruntime140.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: System.Diagnostics.Debug.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb source: mscorrc.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: Microsoft.Win32.Primitives.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\Release\net8.0\System.Reflection.Primitives.pdb source: System.Reflection.Primitives.dll.2.dr
Source:	Binary string: WalletWasabi.Fluent.Desktop\obj\Release\net8.0\win-x64\WalletWasabi.Fluent.Desktop.pdb source: WalletWasabi.Fluent.Desktop.dll.2.dr
Source:	Binary string: System.Private.DataContractSerialization.ni.pdb source: System.Private.DataContractSerialization.dll.2.dr
Source:	Binary string: D:\a\1\s\externals\skia\out\windows\x64\libSkiaSharp.pdb source: libSkiaSharp.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Options/Release/net8.0/Microsoft.Extensions.Options.pdb source: Microsoft.Extensions.Options.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\jdk.security.auth\jaas.pdb source: jaas.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdbSHA256l source: Microsoft.Win32.Primitives.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.SecureString/Release/net8.0-windows/System.Security.SecureString.pdb source: System.Security.SecureString.dll.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: Wasabi.msi, MSIB640.tmp.0.dr, MSIB514.tmp.0.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.OpenSsl/Release/net8.0-windows/System.Security.Cryptography.OpenSsl.pdbSHA256 source: System.Security.Cryptography.OpenSsl.dll.2.dr
Source:	Binary string: vcruntime140.amd64.pdb source: vcruntime140.dll.2.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.2.dr
Source:	Binary string: System.Net.WebSockets.Client.ni.pdb source: System.Net.WebSockets.Client.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebSockets.Client\Release\net8.0\System.Net.WebSockets.Client.pdb source: System.Net.WebSockets.Client.dll.2.dr
Source:	Binary string: WalletWasabi.Fluent.Desktop\obj\Release\net8.0\win-x64\WalletWasabi.Fluent.Desktop.pdbSHA256 source: WalletWasabi.Fluent.Desktop.dll.2.dr
Source:	Binary string: System.Reflection.TypeExtensions.ni.pdb source: System.Reflection.TypeExtensions.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Private.DataContractSerialization/Release/net8.0/System.Private.DataContractSerialization.pdb source: System.Private.DataContractSerialization.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net8.0/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: Microsoft.Extensions.Logging.Abstractions.dll.2.dr
Source:	Binary string: System.Security.Claims.ni.pdb source: System.Security.Claims.dll.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net8.0/Microsoft.Extensions.Logging.Abstractions.pdb source: Microsoft.Extensions.Logging.Abstractions.dll.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: Wasabi.msi
Source:	Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdb source: System.Xml.XmlDocument.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdb source: System.IO.UnmanagedMemoryStream.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Cng/Release/net8.0-windows/System.Security.Cryptography.Cng.pdbSHA256 source: System.Security.Cryptography.Cng.dll.2.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Serialization.Json\Release\net8.0\System.Runtime.Serialization.Json.pdbSHA256 source: System.Runtime.Serialization.Json.dll.2.dr
Source:	Binary string: System.Security.AccessControl.ni.pdb source: System.Security.AccessControl.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: System.ComponentModel.Primitives.dll.2.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.2.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: System.Data.DataSetExtensions.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.ValueTuple/Release/net8.0-windows/System.ValueTuple.pdbSHA256% source: System.ValueTuple.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: System.Security.Claims.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\java.base\zip.pdb(( source: zip.dll.2.dr
Source:	Binary string: Avalonia.Xaml.Interactions.Responsive.pdbSHA256 source: Avalonia.Xaml.Interactions.Responsive.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Primitives\Release\net8.0\System.Reflection.Primitives.pdbSHA256 source: System.Reflection.Primitives.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdbSHA256 source: System.IO.UnmanagedMemoryStream.dll.2.dr
Source:	Binary string: /_/artifacts/obj/System.ValueTuple/Release/net8.0-windows/System.ValueTuple.pdb source: System.ValueTuple.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\java.base\zip.pdb source: zip.dll.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: Wasabi.msi
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: System.Security.Principal.Windows.dll.2.dr
Source:	Binary string: t:\workspace\build\windows-x64\support\modules_libs\jdk.accessibility\javaaccessbridge.pdb source: javaaccessbridge.dll.2.dr

Data Obfuscation

Source: api-ms-win-core-synch-l1-2-0.dll.2.dr

Static PE information: 0xFA2B3792 [Mon Jan 1 23:11:14 2103 UTC]

Source: MSIC3BE.tmp.0.dr	Static PE information: section name: .didat
Source: MSI1F67.tmp.0.dr	Static PE information: section name: .didat
Source: MSI1FB6.tmp.0.dr	Static PE information: section name: .didat
Source: MSI23AF.tmp.0.dr	Static PE information: section name: .didat
Source: clrjit.dll.2.dr	Static PE information: section name: _RDATA
Source: mscordaccore.dll.2.dr	Static PE information: section name: _RDATA

Source: Microsoft.VisualBasic.Core.dll.2.dr

Static PE information: section name: .text entropy: 6.801774101546534

Persistence and Installation Behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\management_agent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Private.CoreLib.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Tasks.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Reactive.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.SecureString.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-environment-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-localization-l1-2-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Transactions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\vcruntime140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Text.Encoding.CodePages.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Splat.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.X509Certificates.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\WindowsBase.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-string-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\WalletWasabi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB4E4.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Pipelines.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21E2.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\libHarfBuzzSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\rmid.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Thread.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\HarfBuzzSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\e_sqlite3.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Sockets.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Win32.Registry.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\zip.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\nio.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.RuntimeInformation.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-synch-l1-2-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Collections.Immutable.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\WabiSabi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Handles.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\java.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\windowsaccessbridge-64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.JavaScript.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Custom.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21C2.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Buffers.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.XPath.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Intrinsics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.TraceSource.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-heap-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.StackTrace.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI1F67.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Private.Uri.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\instrument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reactive.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\hostfxr.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-private-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.Emit.ILGeneration.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Http.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-convert-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI23AF.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-debug-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\MicroCom.Runtime.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jdwp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ServiceProcess.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Private.Xml.Linq.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB476.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Principal.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Csp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.MicroCom.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\netstandard.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.XmlDocument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\SkiaSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-2-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.HttpListener.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-console-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\kinit.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.Tracing.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.FileSystem.AccessControl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\hostpolicy.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\bitcoind.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB514.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Controls.TreeDataGrid.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\javajpeg.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Encoding.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Http.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\prefs.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Base.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Themes.Fluent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Collections.Concurrent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l2-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\SQLitePCLRaw.batteries_v2.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Drawing.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jfr.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Compression.Brotli.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Console.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\mscorlib.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\dt_socket.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\klist.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jawt.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.XDocument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Numerics.Vectors.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Formats.Asn1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.XmlSerializer.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Pipes.AccessControl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Overlapped.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\freetype.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Cng.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.AccessControl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Globalization.Calendars.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.XPath.XDocument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\sunec.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Hosting.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-math-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\clretwrc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\w2k_lsa_auth.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\DynamicData.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\rmi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.DispatchProxy.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.VisualBasic.Core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.Desktop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Linq.Parallel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.ConfigurationExtensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Linq.Queryable.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Web.HttpUtility.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ComponentModel.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\awt.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\SQLitePCLRaw.core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-memory-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-locale-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ComponentModel.TypeConverter.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-string-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Collections.Specialized.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.Binder.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\mscordaccore.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Text.Encoding.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Tmds.DBus.Protocol.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Principal.Windows.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.AspNetCore.WebUtilities.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-utility-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Web.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\net.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Memory.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\ktab.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.FileSystem.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-timezone-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.Serialization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\management.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Events.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Win32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.Tools.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Compression.ZipFile.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Draggable.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\rmiregistry.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jrunscript.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.ReactiveUI.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\clrgc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Requests.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\createdump.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.FreeDesktop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Compression.Native.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Text.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Private.Xml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\mscorrc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Data.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.DiaSymReader.Native.amd64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\fontmanager.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.WebHeaderCollection.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-datetime-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Tasks.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\msvcp140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Ping.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-time-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-process-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\management_ext.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\mscordaccore_amd64_amd64_8.0.324.11423.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ObjectModel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\server\jvm.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ComponentModel.DataAnnotations.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\QRackers.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Data.Common.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\javaaccessbridge.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\j2gss.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Linq.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Desktop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.MemoryMappedFiles.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Formatters.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Drawing.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.NetworkInformation.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Compression.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Timer.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.WebSockets.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Configuration.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Windows.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\splashscreen.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.Contracts.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Fonts.Inter.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.VisualBasic.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\ucrtbase.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\msquic.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.Debug.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\java.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Data.Sqlite.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\coreclr.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Numerics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Dynamic.Runtime.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.OpenGL.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Resources.Reader.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jli.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-conio-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.WebClient.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Claims.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Data.DataSetExtensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.FileSystem.DriveInfo.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-profile-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Private.DataContractSerialization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Win32.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Text.Encoding.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Metal.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.DragAndDrop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\clrjit.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.UnmanagedMemoryStream.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Compression.FileSystem.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\j2pkcs11.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB610.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ValueTuple.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Markup.Xaml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\mscordbi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.AppContext.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.Metadata.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-handle-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\NBitcoin.Secp256k1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB544.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jaccessinspector.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Resources.ResourceManager.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jaas.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Formats.Tar.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\hwi.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jabswitch.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.X11.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.Process.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.Emit.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\javaw.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.WebSockets.Client.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.ThreadPool.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Newtonsoft.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.TypeExtensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-util-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Skia.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Loader.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.Pipes.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.ServicePoint.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\wassabee.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Transactions.Local.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ComponentModel.EventBasedAsync.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.NameResolution.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Mail.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Resources.Writer.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\j2pcsc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.IsolatedStorage.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-synch-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.FileSystem.Watcher.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB640.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jaccesswalker.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ComponentModel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.Unsafe.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.FileVersionInfo.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Globalization.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\NBitcoin.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Linq.Expressions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Dialogs.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Collections.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Memory.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ServiceModel.Web.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\lcms.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\SQLitePCLRaw.provider.e_sqlite3.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Quic.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Win32.SystemEvents.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB3F8.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactivity.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.ComponentModel.Annotations.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Net.Http.Headers.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\verify.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Controls.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.TextWriterTraceListener.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\av_libglesv2.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Collections.NonGeneric.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\mlib_image.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Reflection.Emit.Lightweight.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Text.RegularExpressions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.IO.FileSystem.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Http.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Native.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.Linq.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jsound.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Responsive.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\keytool.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\jimage.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.Algorithms.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIC3BE.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\ReactiveUI.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Xml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\tor.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2163.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\libSkiaSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2231.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Remote.Protocol.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.VisualC.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.Security.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.DesignerSupport.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Tasks.Dataflow.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Channels.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Avalonia.Markup.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Xml.ReaderWriter.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Threading.Tasks.Parallel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Text.Encodings.Web.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.Extensions.FileProviders.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Numerics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Runtime.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-heap-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Net.WebProxy.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Security.Cryptography.OpenSsl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Globalization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI1FB6.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\Microsoft.CSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\WasabiWallet\System.Diagnostics.DiagnosticSource.dll			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2163.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2231.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21C2.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21E2.tmp			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\WasabiWallet\jre\conf\security\policy\README.txt

Jump to behavior

Boot Survival

Source: C:\Windows\System32\msiexec.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC265529287B83643A5181680F642157 D74372E74838EC6409E2A1B7B11BA8FD C:\Program Files\WasabiWallet\jre\bin\javaw.exe

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WasabiWallet			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WasabiWallet\Wasabi Wallet.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\management_agent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Private.CoreLib.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Tasks.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Reactive.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.SecureString.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Transactions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-localization-l1-2-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-environment-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\vcruntime140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Text.Encoding.CodePages.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Splat.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.X509Certificates.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\WindowsBase.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\WalletWasabi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-string-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB4E4.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Pipelines.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI21E2.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\libHarfBuzzSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\rmid.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\HarfBuzzSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Thread.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\e_sqlite3.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Sockets.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\zip.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Win32.Registry.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\nio.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.RuntimeInformation.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Collections.Immutable.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-synch-l1-2-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Handles.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\WabiSabi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\java.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\windowsaccessbridge-64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.JavaScript.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Custom.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Buffers.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI21C2.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.XPath.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Intrinsics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.TraceSource.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.StackTrace.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-heap-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI1F67.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Private.Uri.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\instrument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reactive.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\hostfxr.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-private-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Http.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.Emit.ILGeneration.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-convert-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\MicroCom.Runtime.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-debug-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI23AF.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ServiceProcess.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jdwp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Private.Xml.Linq.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Principal.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB476.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.Csp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.MicroCom.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\netstandard.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\SkiaSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-2-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.XmlDocument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.HttpListener.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-console-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\kinit.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.Tracing.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.FileSystem.AccessControl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\hostpolicy.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\bitcoind.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Controls.TreeDataGrid.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB514.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\javajpeg.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.Encoding.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Http.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\prefs.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Base.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Themes.Fluent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Collections.Concurrent.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l2-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\SQLitePCLRaw.batteries_v2.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Drawing.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jfr.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Compression.Brotli.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Console.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\mscorlib.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\dt_socket.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\klist.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-file-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jawt.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Serialization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.XDocument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Numerics.Vectors.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Formats.Asn1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.XmlSerializer.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Pipes.AccessControl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Overlapped.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\freetype.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.AccessControl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.Cng.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Globalization.Calendars.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.XPath.XDocument.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\sunec.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-math-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Hosting.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\clretwrc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\w2k_lsa_auth.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\DynamicData.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\rmi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.DispatchProxy.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.VisualBasic.Core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Linq.Parallel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\WalletWasabi.Fluent.Desktop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.ConfigurationExtensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Linq.Queryable.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ComponentModel.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Web.HttpUtility.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\awt.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\SQLitePCLRaw.core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-memory-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ComponentModel.TypeConverter.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-locale-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-string-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.Binder.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Collections.Specialized.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\mscordaccore.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Text.Encoding.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Tmds.DBus.Protocol.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Principal.Windows.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.AspNetCore.WebUtilities.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-utility-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Web.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\net.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\ktab.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Memory.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.FileSystem.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-timezone-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.Serialization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\management.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Events.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Win32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.Tools.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Compression.ZipFile.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Draggable.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\rmiregistry.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jrunscript.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.ReactiveUI.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\clrgc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Requests.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\createdump.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.FreeDesktop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Compression.Native.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Text.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Private.Xml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\mscorrc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Data.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.DiaSymReader.Native.amd64.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Options.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\fontmanager.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.WebHeaderCollection.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Tasks.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-datetime-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\msvcp140.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-time-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Ping.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-process-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\management_ext.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\mscordaccore_amd64_amd64_8.0.324.11423.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Logging.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ObjectModel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\server\jvm.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ComponentModel.DataAnnotations.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\QRackers.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Data.Common.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\javaaccessbridge.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\j2gss.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Linq.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Desktop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.MemoryMappedFiles.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Drawing.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Formatters.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.NetworkInformation.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Compression.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Timer.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.WebSockets.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Configuration.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\splashscreen.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Windows.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.Contracts.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Fonts.Inter.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.VisualBasic.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\msquic.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\java.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.Debug.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Data.Sqlite.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\coreclr.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Numerics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Dynamic.Runtime.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.OpenGL.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Resources.Reader.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jli.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-conio-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.WebClient.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Data.DataSetExtensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Claims.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.FileSystem.DriveInfo.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Private.DataContractSerialization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Text.Encoding.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Win32.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-profile-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.DragAndDrop.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Metal.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\clrjit.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.UnmanagedMemoryStream.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Compression.FileSystem.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\j2pkcs11.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB610.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ValueTuple.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Markup.Xaml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\mscordbi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.Metadata.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.AppContext.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-handle-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\NBitcoin.Secp256k1.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB544.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jaccessinspector.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Caching.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Resources.ResourceManager.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jaas.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\hwi.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jabswitch.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Formats.Tar.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.X11.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.Process.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\javaw.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.Emit.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.WebSockets.Client.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.InteropServices.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.ThreadPool.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Newtonsoft.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.TypeExtensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-util-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Skia.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Loader.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.Pipes.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.ServicePoint.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\wassabee.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Transactions.Local.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.NameResolution.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ComponentModel.EventBasedAsync.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Mail.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Resources.Writer.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\j2pcsc.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.IsolatedStorage.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-synch-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.FileSystem.Watcher.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB640.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jaccesswalker.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ComponentModel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.DependencyInjection.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.Unsafe.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.FileVersionInfo.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Globalization.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\NBitcoin.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Linq.Expressions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Dialogs.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Collections.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ServiceModel.Web.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Memory.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\lcms.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\SQLitePCLRaw.provider.e_sqlite3.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Diagnostics.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Quic.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Win32.SystemEvents.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\WalletWasabi.Daemon.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.Configuration.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.ComponentModel.Annotations.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB3F8.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactivity.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Net.Http.Headers.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.Primitives.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\verify.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Controls.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.TextWriterTraceListener.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\av_libglesv2.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Collections.NonGeneric.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\mlib_image.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Reflection.Emit.Lightweight.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Text.RegularExpressions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.IO.FileSystem.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Native.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Http.Json.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.Linq.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jsound.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Xaml.Interactions.Responsive.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\keytool.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\jimage.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.Algorithms.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC3BE.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\ReactiveUI.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microservices\Binaries\win64\Tor\tor.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Serialization.Xml.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2163.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\libSkiaSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2231.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Remote.Protocol.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.CompilerServices.VisualC.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.Security.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.DesignerSupport.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Tasks.Dataflow.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Avalonia.Markup.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Channels.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Xml.ReaderWriter.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.Extensions.FileProviders.Abstractions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Threading.Tasks.Parallel.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Text.Encodings.Web.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Numerics.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Runtime.Extensions.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-core-heap-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Security.Cryptography.OpenSsl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Net.WebProxy.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Globalization.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI1FB6.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\Microsoft.CSharp.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\WasabiWallet\System.Diagnostics.DiagnosticSource.dll			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ZKsnacks\Wasabi Wallet\prerequisites\Wasabi\Wasabi.msi"

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior