Overview

overview

8

Static

static

Bonzify.exe

windows10-2004-x64

8

Resubmissions

16-01-2023 10:07

230116-l5vegshc3x 10

10-01-2023 20:37

230110-zebfksdc9t 10

10-01-2023 18:54

230110-xkgtfach4v 8

10-01-2023 18:48

230110-xf68jacg9t 8

10-01-2023 18:47

230110-xfkpjaha65 8

10-01-2023 18:44

230110-xdm2wacg6t 8

Analysis

  • max time kernel
    104s
  • max time network
    322s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2023 18:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bonzify.exe

  • Size

    6.4MB

  • MD5

    fba93d8d029e85e0cde3759b7903cee2

  • SHA1

    525b1aa549188f4565c75ab69e51f927204ca384

  • SHA256

    66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764

  • SHA512

    7c1441b2e804e925eb5a03e97db620117d3ad4f6981dc020e4e7df4bfc4bd6e414fa3b0ce764481a2cef07eebb2baa87407355bfbe88fab96397d82bd441e6a2

  • SSDEEP

    196608:adAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:OaWedh+Idx75QYub//73lc6u7bLMYxD

Score
8/10
discoveryexploitpersistence

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Loads dropped DLL 16 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 56 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bonzify.exe
    "C:\Users\Admin\AppData\Local\Temp\Bonzify.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im AgentSvr.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2456
      • C:\Windows\SysWOW64\takeown.exe
        takeown /r /d y /f C:\Windows\MsAgent
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1796
      • C:\Windows\SysWOW64\icacls.exe
        icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4288
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\f\autoconv.exe"
      2⤵
        PID:4460
      • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
        INSTALLER.exe /q
        2⤵
        • Executes dropped EXE
        • Modifies Installed Components in the registry
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:100
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4972
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:5032
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
          3⤵
          • Loads dropped DLL
          PID:3632
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
          3⤵
          • Loads dropped DLL
          PID:4540
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4528
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
          3⤵
          • Loads dropped DLL
          PID:3420
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4964
        • C:\Windows\msagent\AgentSvr.exe
          "C:\Windows\msagent\AgentSvr.exe" /regserver
          3⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:4472
        • C:\Windows\SysWOW64\grpconv.exe
          grpconv.exe -o
          3⤵
            PID:3240
        • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
          INSTALLER.exe /q
          2⤵
          • Executes dropped EXE
          • Modifies Installed Components in the registry
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
            3⤵
            • Loads dropped DLL
            PID:4668
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
            3⤵
            • Loads dropped DLL
            PID:3364
          • C:\Windows\SysWOW64\grpconv.exe
            grpconv.exe -o
            3⤵
              PID:1312
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3136
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          1⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8890e4f50,0x7ff8890e4f60,0x7ff8890e4f70
            2⤵
              PID:2704
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:2
              2⤵
                PID:3920
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1904 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4340
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:8
                2⤵
                  PID:4000
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
                  2⤵
                    PID:4680
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
                    2⤵
                      PID:4576
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                      2⤵
                        PID:1432
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:8
                        2⤵
                          PID:116
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:8
                          2⤵
                            PID:32
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:8
                            2⤵
                              PID:3564
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4592 /prefetch:8
                              2⤵
                                PID:2444
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3964
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
                                2⤵
                                  PID:4020
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:8
                                  2⤵
                                    PID:2440
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1708
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:8
                                    2⤵
                                      PID:3516
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                      2⤵
                                        PID:1768
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6076
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6140
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1096 /prefetch:8
                                        2⤵
                                          PID:3588
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:8
                                          2⤵
                                            PID:3924
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5352
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3488 /prefetch:8
                                            2⤵
                                              PID:4804
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3988 /prefetch:8
                                              2⤵
                                                PID:5788
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
                                                2⤵
                                                  PID:2988
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5448 /prefetch:8
                                                  2⤵
                                                    PID:5884
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:8
                                                    2⤵
                                                      PID:5784
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4916 /prefetch:8
                                                      2⤵
                                                        PID:4992
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2752 /prefetch:2
                                                        2⤵
                                                          PID:6044
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5740 /prefetch:8
                                                          2⤵
                                                            PID:1060
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:8
                                                            2⤵
                                                              PID:1760
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:8
                                                              2⤵
                                                                PID:5792
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:8
                                                                2⤵
                                                                  PID:5596
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5544 /prefetch:8
                                                                  2⤵
                                                                    PID:5588
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:8
                                                                    2⤵
                                                                      PID:5360
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5608 /prefetch:8
                                                                      2⤵
                                                                        PID:5352
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
                                                                        2⤵
                                                                          PID:5600
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
                                                                          2⤵
                                                                            PID:4068
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5576 /prefetch:8
                                                                            2⤵
                                                                              PID:5796
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
                                                                              2⤵
                                                                                PID:5744
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:8
                                                                                2⤵
                                                                                  PID:3064
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:8
                                                                                  2⤵
                                                                                    PID:5752
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:8
                                                                                    2⤵
                                                                                      PID:5688
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5496 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3416
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4648
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:8
                                                                                          2⤵
                                                                                            PID:5760
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:8
                                                                                            2⤵
                                                                                              PID:5652
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
                                                                                              2⤵
                                                                                                PID:3120
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6940408929242964349,11373664045500414020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:4708
                                                                                              • C:\Windows\msagent\AgentSvr.exe
                                                                                                C:\Windows\msagent\AgentSvr.exe -Embedding
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                PID:4600
                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:444
                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x4ec 0x4e0
                                                                                                  1⤵
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:960
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                  • Modifies Installed Components in the registry
                                                                                                  • Enumerates connected drives
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1948
                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                    2⤵
                                                                                                    • Checks SCSI registry key(s)
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5908
                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                    2⤵
                                                                                                      PID:4276
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:780
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5128

                                                                                                  Network

                                                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                                                  Initial Access

                                                                                                  Execution

                                                                                                  Persistence

                                                                                                  Registry Run Keys / Startup Folder

                                                                                                  3
                                                                                                  T1060

                                                                                                  Privilege Escalation

                                                                                                  Defense Evasion

                                                                                                  Modify Registry

                                                                                                  4
                                                                                                  T1112

                                                                                                  File Permissions Modification

                                                                                                  1
                                                                                                  T1222

                                                                                                  Credential Access

                                                                                                  Discovery

                                                                                                  Query Registry

                                                                                                  5
                                                                                                  T1012

                                                                                                  Peripheral Device Discovery

                                                                                                  2
                                                                                                  T1120

                                                                                                  System Information Discovery

                                                                                                  4
                                                                                                  T1082

                                                                                                  Lateral Movement

                                                                                                  Collection

                                                                                                  Exfiltration

                                                                                                  Command and Control

                                                                                                  Impact

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    MD5

                                                                                                    d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                    SHA1

                                                                                                    2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                    SHA256

                                                                                                    b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                    SHA512

                                                                                                    c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                    Filesize

                                                                                                    4B

                                                                                                    MD5

                                                                                                    f49655f856acb8884cc0ace29216f511

                                                                                                    SHA1

                                                                                                    cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                    SHA256

                                                                                                    7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                    SHA512

                                                                                                    599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                    Filesize

                                                                                                    944B

                                                                                                    MD5

                                                                                                    6bd369f7c74a28194c991ed1404da30f

                                                                                                    SHA1

                                                                                                    0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                    SHA256

                                                                                                    878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                    SHA512

                                                                                                    8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
                                                                                                    MD5

                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                    SHA1

                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                    SHA256

                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                    SHA512

                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                    Filesize

                                                                                                    28KB

                                                                                                    MD5

                                                                                                    20cb970815eaa7afb575f22ff01bb2b6

                                                                                                    SHA1

                                                                                                    cd2de04341289da22935135af04a88ae2e94086e

                                                                                                    SHA256

                                                                                                    4911b72bcbd23e55d29f8d3d0995742c6ebfdc74f8bd7e5fa420ce98b1326923

                                                                                                    SHA512

                                                                                                    da2487a55246c997928ede64db547d67f110535966c6262de1bfdbb5a256f71fb3e73365c85e492d891f6a86085f674809fbbcb445ad16aa3a7604b948d3891b

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                                    Filesize

                                                                                                    391KB

                                                                                                    MD5

                                                                                                    66996a076065ebdcdac85ff9637ceae0

                                                                                                    SHA1

                                                                                                    4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce

                                                                                                    SHA256

                                                                                                    16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa

                                                                                                    SHA512

                                                                                                    e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                                    Filesize

                                                                                                    391KB

                                                                                                    MD5

                                                                                                    66996a076065ebdcdac85ff9637ceae0

                                                                                                    SHA1

                                                                                                    4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce

                                                                                                    SHA256

                                                                                                    16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa

                                                                                                    SHA512

                                                                                                    e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                                    Filesize

                                                                                                    997KB

                                                                                                    MD5

                                                                                                    3f8f18c9c732151dcdd8e1d8fe655896

                                                                                                    SHA1

                                                                                                    222cc49201aa06313d4d35a62c5d494af49d1a56

                                                                                                    SHA256

                                                                                                    709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331

                                                                                                    SHA512

                                                                                                    398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                                    Filesize

                                                                                                    997KB

                                                                                                    MD5

                                                                                                    3f8f18c9c732151dcdd8e1d8fe655896

                                                                                                    SHA1

                                                                                                    222cc49201aa06313d4d35a62c5d494af49d1a56

                                                                                                    SHA256

                                                                                                    709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331

                                                                                                    SHA512

                                                                                                    398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                                                                                    Filesize

                                                                                                    73KB

                                                                                                    MD5

                                                                                                    81e5c8596a7e4e98117f5c5143293020

                                                                                                    SHA1

                                                                                                    45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

                                                                                                    SHA256

                                                                                                    7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

                                                                                                    SHA512

                                                                                                    05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                                                                                    Filesize

                                                                                                    73KB

                                                                                                    MD5

                                                                                                    81e5c8596a7e4e98117f5c5143293020

                                                                                                    SHA1

                                                                                                    45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

                                                                                                    SHA256

                                                                                                    7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

                                                                                                    SHA512

                                                                                                    05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KillAgent.bat
                                                                                                    Filesize

                                                                                                    161B

                                                                                                    MD5

                                                                                                    ea7df060b402326b4305241f21f39736

                                                                                                    SHA1

                                                                                                    7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

                                                                                                    SHA256

                                                                                                    e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

                                                                                                    SHA512

                                                                                                    3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

                                                                                                    Download Submit
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat
                                                                                                    Filesize

                                                                                                    46B

                                                                                                    MD5

                                                                                                    f80e36cd406022944558d8a099db0fa7

                                                                                                    SHA1

                                                                                                    fd7e93ca529ed760ff86278fbfa5ba0496e581ce

                                                                                                    SHA256

                                                                                                    7b41e5a6c2dd92f60c38cb4fe09dcbe378c3e99443f7baf079ece3608497bdc7

                                                                                                    SHA512

                                                                                                    436e711ede85a02cd87ea312652ddbf927cf8df776448326b1e974d0a3719a9535952f4d3cc0d3cd4e3551b57231d7e916f317b119ab670e5f47284a90ab59a2

                                                                                                    Download Submit
                                                                                                  • C:\Windows\SysWOW64\MSVCP50.dll
                                                                                                    Filesize

                                                                                                    552KB

                                                                                                    MD5

                                                                                                    497fd4a8f5c4fcdaaac1f761a92a366a

                                                                                                    SHA1

                                                                                                    81617006e93f8a171b2c47581c1d67fac463dc93

                                                                                                    SHA256

                                                                                                    91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                                                    SHA512

                                                                                                    73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                                                    Download Submit
                                                                                                  • C:\Windows\SysWOW64\msvcp50.dll
                                                                                                    Filesize

                                                                                                    552KB

                                                                                                    MD5

                                                                                                    497fd4a8f5c4fcdaaac1f761a92a366a

                                                                                                    SHA1

                                                                                                    81617006e93f8a171b2c47581c1d67fac463dc93

                                                                                                    SHA256

                                                                                                    91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                                                    SHA512

                                                                                                    73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                                                    Download Submit
                                                                                                  • C:\Windows\SysWOW64\msvcp50.dll
                                                                                                    Filesize

                                                                                                    552KB

                                                                                                    MD5

                                                                                                    497fd4a8f5c4fcdaaac1f761a92a366a

                                                                                                    SHA1

                                                                                                    81617006e93f8a171b2c47581c1d67fac463dc93

                                                                                                    SHA256

                                                                                                    91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                                                    SHA512

                                                                                                    73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                                                    Download Submit
                                                                                                  • C:\Windows\lhsp\tv\tv_enua.dll
                                                                                                    Filesize

                                                                                                    1.2MB

                                                                                                    MD5

                                                                                                    ed98e67fa8cc190aad0757cd620e6b77

                                                                                                    SHA1

                                                                                                    0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                                                    SHA256

                                                                                                    e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                                                    SHA512

                                                                                                    ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                                                    Download Submit
                                                                                                  • C:\Windows\lhsp\tv\tv_enua.dll
                                                                                                    Filesize

                                                                                                    1.2MB

                                                                                                    MD5

                                                                                                    ed98e67fa8cc190aad0757cd620e6b77

                                                                                                    SHA1

                                                                                                    0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                                                    SHA256

                                                                                                    e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                                                    SHA512

                                                                                                    ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                                                    Download Submit
                                                                                                  • C:\Windows\lhsp\tv\tv_enua.dll
                                                                                                    Filesize

                                                                                                    1.2MB

                                                                                                    MD5

                                                                                                    ed98e67fa8cc190aad0757cd620e6b77

                                                                                                    SHA1

                                                                                                    0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                                                    SHA256

                                                                                                    e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                                                    SHA512

                                                                                                    ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                                                    Download Submit
                                                                                                  • C:\Windows\lhsp\tv\tvenuax.dll
                                                                                                    Filesize

                                                                                                    40KB

                                                                                                    MD5

                                                                                                    1587bf2e99abeeae856f33bf98d3512e

                                                                                                    SHA1

                                                                                                    aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

                                                                                                    SHA256

                                                                                                    c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

                                                                                                    SHA512

                                                                                                    43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

                                                                                                    Download Submit
                                                                                                  • C:\Windows\lhsp\tv\tvenuax.dll
                                                                                                    Filesize

                                                                                                    40KB

                                                                                                    MD5

                                                                                                    1587bf2e99abeeae856f33bf98d3512e

                                                                                                    SHA1

                                                                                                    aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

                                                                                                    SHA256

                                                                                                    c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

                                                                                                    SHA512

                                                                                                    43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentCtl.dll
                                                                                                    Filesize

                                                                                                    160KB

                                                                                                    MD5

                                                                                                    237e13b95ab37d0141cf0bc585b8db94

                                                                                                    SHA1

                                                                                                    102c6164c21de1f3e0b7d487dd5dc4c5249e0994

                                                                                                    SHA256

                                                                                                    d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

                                                                                                    SHA512

                                                                                                    9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentCtl.dll
                                                                                                    Filesize

                                                                                                    160KB

                                                                                                    MD5

                                                                                                    237e13b95ab37d0141cf0bc585b8db94

                                                                                                    SHA1

                                                                                                    102c6164c21de1f3e0b7d487dd5dc4c5249e0994

                                                                                                    SHA256

                                                                                                    d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

                                                                                                    SHA512

                                                                                                    9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentDP2.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    a334bbf5f5a19b3bdb5b7f1703363981

                                                                                                    SHA1

                                                                                                    6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                                                    SHA256

                                                                                                    c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                                                    SHA512

                                                                                                    1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentDPv.dll
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    MD5

                                                                                                    7c5aefb11e797129c9e90f279fbdf71b

                                                                                                    SHA1

                                                                                                    cb9d9cbfbebb5aed6810a4e424a295c27520576e

                                                                                                    SHA256

                                                                                                    394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

                                                                                                    SHA512

                                                                                                    df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentDPv.dll
                                                                                                    Filesize

                                                                                                    64KB

                                                                                                    MD5

                                                                                                    7c5aefb11e797129c9e90f279fbdf71b

                                                                                                    SHA1

                                                                                                    cb9d9cbfbebb5aed6810a4e424a295c27520576e

                                                                                                    SHA256

                                                                                                    394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

                                                                                                    SHA512

                                                                                                    df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentDp2.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    a334bbf5f5a19b3bdb5b7f1703363981

                                                                                                    SHA1

                                                                                                    6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                                                    SHA256

                                                                                                    c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                                                    SHA512

                                                                                                    1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentDp2.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    a334bbf5f5a19b3bdb5b7f1703363981

                                                                                                    SHA1

                                                                                                    6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                                                    SHA256

                                                                                                    c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                                                    SHA512

                                                                                                    1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentMPx.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    4fbbaac42cf2ecb83543f262973d07c0

                                                                                                    SHA1

                                                                                                    ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                                                    SHA256

                                                                                                    6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                                                    SHA512

                                                                                                    4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentMPx.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    4fbbaac42cf2ecb83543f262973d07c0

                                                                                                    SHA1

                                                                                                    ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                                                    SHA256

                                                                                                    6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                                                    SHA512

                                                                                                    4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentMPx.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    4fbbaac42cf2ecb83543f262973d07c0

                                                                                                    SHA1

                                                                                                    ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                                                    SHA256

                                                                                                    6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                                                    SHA512

                                                                                                    4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentPsh.dll
                                                                                                    Filesize

                                                                                                    36KB

                                                                                                    MD5

                                                                                                    b4ac608ebf5a8fdefa2d635e83b7c0e8

                                                                                                    SHA1

                                                                                                    d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

                                                                                                    SHA256

                                                                                                    8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

                                                                                                    SHA512

                                                                                                    2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentPsh.dll
                                                                                                    Filesize

                                                                                                    36KB

                                                                                                    MD5

                                                                                                    b4ac608ebf5a8fdefa2d635e83b7c0e8

                                                                                                    SHA1

                                                                                                    d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

                                                                                                    SHA256

                                                                                                    8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

                                                                                                    SHA512

                                                                                                    2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentSR.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    9fafb9d0591f2be4c2a846f63d82d301

                                                                                                    SHA1

                                                                                                    1df97aa4f3722b6695eac457e207a76a6b7457be

                                                                                                    SHA256

                                                                                                    e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

                                                                                                    SHA512

                                                                                                    ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentSR.dll
                                                                                                    Filesize

                                                                                                    60KB

                                                                                                    MD5

                                                                                                    9fafb9d0591f2be4c2a846f63d82d301

                                                                                                    SHA1

                                                                                                    1df97aa4f3722b6695eac457e207a76a6b7457be

                                                                                                    SHA256

                                                                                                    e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

                                                                                                    SHA512

                                                                                                    ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentSvr.exe
                                                                                                    Filesize

                                                                                                    268KB

                                                                                                    MD5

                                                                                                    5c91bf20fe3594b81052d131db798575

                                                                                                    SHA1

                                                                                                    eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                                                    SHA256

                                                                                                    e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                                                    SHA512

                                                                                                    face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentSvr.exe
                                                                                                    Filesize

                                                                                                    268KB

                                                                                                    MD5

                                                                                                    5c91bf20fe3594b81052d131db798575

                                                                                                    SHA1

                                                                                                    eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                                                    SHA256

                                                                                                    e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                                                    SHA512

                                                                                                    face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\AgentSvr.exe
                                                                                                    Filesize

                                                                                                    268KB

                                                                                                    MD5

                                                                                                    5c91bf20fe3594b81052d131db798575

                                                                                                    SHA1

                                                                                                    eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                                                    SHA256

                                                                                                    e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                                                    SHA512

                                                                                                    face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\chars\Bonzi.acs
                                                                                                    Filesize

                                                                                                    5.0MB

                                                                                                    MD5

                                                                                                    1fd2907e2c74c9a908e2af5f948006b5

                                                                                                    SHA1

                                                                                                    a390e9133bfd0d55ffda07d4714af538b6d50d3d

                                                                                                    SHA256

                                                                                                    f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95

                                                                                                    SHA512

                                                                                                    8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\intl\Agt0409.dll
                                                                                                    Filesize

                                                                                                    28KB

                                                                                                    MD5

                                                                                                    0cbf0f4c9e54d12d34cd1a772ba799e1

                                                                                                    SHA1

                                                                                                    40e55eb54394d17d2d11ca0089b84e97c19634a7

                                                                                                    SHA256

                                                                                                    6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

                                                                                                    SHA512

                                                                                                    bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\mslwvtts.dll
                                                                                                    Filesize

                                                                                                    52KB

                                                                                                    MD5

                                                                                                    316999655fef30c52c3854751c663996

                                                                                                    SHA1

                                                                                                    a7862202c3b075bdeb91c5e04fe5ff71907dae59

                                                                                                    SHA256

                                                                                                    ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

                                                                                                    SHA512

                                                                                                    5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

                                                                                                    Download Submit
                                                                                                  • C:\Windows\msagent\mslwvtts.dll
                                                                                                    Filesize

                                                                                                    52KB

                                                                                                    MD5

                                                                                                    316999655fef30c52c3854751c663996

                                                                                                    SHA1

                                                                                                    a7862202c3b075bdeb91c5e04fe5ff71907dae59

                                                                                                    SHA256

                                                                                                    ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

                                                                                                    SHA512

                                                                                                    5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

                                                                                                    Download Submit
                                                                                                  • \??\pipe\crashpad_2976_OFKGUMKUXUYZVMIL
                                                                                                    MD5

                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                    SHA1

                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                    SHA256

                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                    SHA512

                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                    Download Submit
                                                                                                  • memory/100-138-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1000-132-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1312-180-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/1796-135-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2248-168-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/2456-134-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3240-167-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3364-177-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3420-158-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/3632-149-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4276-274-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4288-136-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4460-137-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4472-164-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4528-155-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4540-152-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4668-172-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4964-161-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/4972-143-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/5032-146-0x0000000000000000-mapping.dmp
                                                                                                    Download
                                                                                                  • memory/5128-227-0x0000026B6A0B3000-0x0000026B6A0B7000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-205-0x0000026B6A08C000-0x0000026B6A08F000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-211-0x0000026B6A090000-0x0000026B6A094000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-212-0x0000026B6A090000-0x0000026B6A094000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-209-0x0000026B6A090000-0x0000026B6A094000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-215-0x0000026B6A0A0000-0x0000026B6A0A3000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-217-0x0000026B6A0A0000-0x0000026B6A0A3000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-216-0x0000026B6A0A0000-0x0000026B6A0A3000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-219-0x0000026B68370000-0x0000026B68378000-memory.dmp
                                                                                                    Filesize

                                                                                                    32KB

                                                                                                    Download
                                                                                                  • memory/5128-224-0x0000026B6A0AE000-0x0000026B6A0B1000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-223-0x0000026B6A0AE000-0x0000026B6A0B1000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-222-0x0000026B6A0AE000-0x0000026B6A0B1000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-208-0x0000026B6A090000-0x0000026B6A094000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-228-0x0000026B6A0B3000-0x0000026B6A0B7000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-229-0x0000026B6A0B3000-0x0000026B6A0B7000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-230-0x0000026B6A0B3000-0x0000026B6A0B7000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-233-0x0000026B6A0B7000-0x0000026B6A0BA000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-234-0x0000026B6A0B7000-0x0000026B6A0BA000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-235-0x0000026B6A0B7000-0x0000026B6A0BA000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-198-0x0000026B68200000-0x0000026B68220000-memory.dmp
                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download
                                                                                                  • memory/5128-204-0x0000026B6A08C000-0x0000026B6A08F000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-210-0x0000026B6A090000-0x0000026B6A094000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-206-0x0000026B6A08C000-0x0000026B6A08F000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-203-0x0000026B6A08C000-0x0000026B6A08F000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-244-0x0000026B6A0C4000-0x0000026B6A0C7000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-243-0x0000026B6A0C4000-0x0000026B6A0C7000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-245-0x0000026B6A0C4000-0x0000026B6A0C7000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-248-0x0000026B6A0CE000-0x0000026B6A0D1000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-249-0x0000026B6A0CE000-0x0000026B6A0D1000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-250-0x0000026B6A0CE000-0x0000026B6A0D1000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-254-0x0000026B6A0D7000-0x0000026B6A0DA000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-256-0x0000026B6A0D7000-0x0000026B6A0DA000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-255-0x0000026B6A0D7000-0x0000026B6A0DA000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-261-0x0000026B6A10F000-0x0000026B6A112000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-262-0x0000026B6A10F000-0x0000026B6A112000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-263-0x0000026B6A10F000-0x0000026B6A112000-memory.dmp
                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    Download
                                                                                                  • memory/5128-267-0x0000026B6A14F000-0x0000026B6A153000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-266-0x0000026B6A14F000-0x0000026B6A153000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-268-0x0000026B6A14F000-0x0000026B6A153000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5128-269-0x0000026B6A14F000-0x0000026B6A153000-memory.dmp
                                                                                                    Filesize

                                                                                                    16KB

                                                                                                    Download
                                                                                                  • memory/5908-237-0x0000000000000000-mapping.dmp
                                                                                                    Download