Overview

overview

8

Static

static

Bonzify.exe

windows10-2004-x64

8

Resubmissions

16-01-2023 10:07

230116-l5vegshc3x 10

10-01-2023 20:37

230110-zebfksdc9t 10

10-01-2023 18:54

230110-xkgtfach4v 8

10-01-2023 18:48

230110-xf68jacg9t 8

10-01-2023 18:47

230110-xfkpjaha65 8

10-01-2023 18:44

230110-xdm2wacg6t 8

Analysis

  • max time kernel
    149s
  • max time network
    541s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2023 18:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bonzify.exe

  • Size

    6.4MB

  • MD5

    fba93d8d029e85e0cde3759b7903cee2

  • SHA1

    525b1aa549188f4565c75ab69e51f927204ca384

  • SHA256

    66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764

  • SHA512

    7c1441b2e804e925eb5a03e97db620117d3ad4f6981dc020e4e7df4bfc4bd6e414fa3b0ce764481a2cef07eebb2baa87407355bfbe88fab96397d82bd441e6a2

  • SSDEEP

    196608:adAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:OaWedh+Idx75QYub//73lc6u7bLMYxD

Score
8/10
discoveryexploitpersistence

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Loads dropped DLL 16 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 57 IoCs
  • Checks SCSI registry key(s) 3 TTPs 61 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bonzify.exe
    "C:\Users\Admin\AppData\Local\Temp\Bonzify.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im AgentSvr.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4064
      • C:\Windows\SysWOW64\takeown.exe
        takeown /r /d y /f C:\Windows\MsAgent
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4988
      • C:\Windows\SysWOW64\icacls.exe
        icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4896
    • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
      INSTALLER.exe /q
      2⤵
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1100
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3672
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3424
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
        3⤵
        • Loads dropped DLL
        PID:2260
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3924
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
        3⤵
        • Loads dropped DLL
        PID:4272
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3356
      • C:\Windows\msagent\AgentSvr.exe
        "C:\Windows\msagent\AgentSvr.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:2424
      • C:\Windows\SysWOW64\grpconv.exe
        grpconv.exe -o
        3⤵
          PID:3864
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat "C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\f\recdisc.exe"
        2⤵
          PID:1324
        • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
          INSTALLER.exe /q
          2⤵
          • Executes dropped EXE
          • Modifies Installed Components in the registry
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
            3⤵
            • Loads dropped DLL
            PID:4432
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
            3⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:2228
          • C:\Windows\SysWOW64\grpconv.exe
            grpconv.exe -o
            3⤵
              PID:4088
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3944
        • C:\Windows\msagent\AgentSvr.exe
          C:\Windows\msagent\AgentSvr.exe -Embedding
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3976
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x478 0x410
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3876
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4864
          • C:\Windows\system32\mspaint.exe
            "C:\Windows\system32\mspaint.exe"
            2⤵
              PID:1232
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              2⤵
                PID:3432
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd77b34f50,0x7ffd77b34f60,0x7ffd77b34f70
                  3⤵
                    PID:1900
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1684 /prefetch:2
                    3⤵
                      PID:828
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2024 /prefetch:8
                      3⤵
                        PID:2676
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:8
                        3⤵
                          PID:4392
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
                          3⤵
                            PID:4228
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
                            3⤵
                              PID:1496
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
                              3⤵
                                PID:3080
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:8
                                3⤵
                                  PID:1992
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4648 /prefetch:8
                                  3⤵
                                    PID:504
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,17613816256168111849,1830083904061216472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4780 /prefetch:8
                                    3⤵
                                      PID:3328
                                  • C:\Windows\System32\nslookup.exe
                                    "C:\Windows\System32\nslookup.exe"
                                    2⤵
                                      PID:3032
                                    • C:\Windows\System32\ofdeploy.exe
                                      "C:\Windows\System32\ofdeploy.exe"
                                      2⤵
                                        PID:1812
                                      • C:\Windows\System32\odbcad32.exe
                                        "C:\Windows\System32\odbcad32.exe"
                                        2⤵
                                          PID:2516
                                        • C:\Windows\System32\omadmclient.exe
                                          "C:\Windows\System32\omadmclient.exe"
                                          2⤵
                                            PID:5104
                                          • C:\Windows\System32\omadmprc.exe
                                            "C:\Windows\System32\omadmprc.exe"
                                            2⤵
                                              PID:4072
                                            • C:\Windows\System32\osk.exe
                                              "C:\Windows\System32\osk.exe"
                                              2⤵
                                                PID:3240
                                              • C:\Windows\System32\OptionalFeatures.exe
                                                "C:\Windows\System32\OptionalFeatures.exe"
                                                2⤵
                                                  PID:4844
                                                • C:\Windows\System32\pcalua.exe
                                                  "C:\Windows\System32\pcalua.exe"
                                                  2⤵
                                                    PID:4924
                                                  • C:\Windows\System32\pcwrun.exe
                                                    "C:\Windows\System32\pcwrun.exe"
                                                    2⤵
                                                      PID:2608
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                      2⤵
                                                        PID:384
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd77b34f50,0x7ffd77b34f60,0x7ffd77b34f70
                                                          3⤵
                                                            PID:1888
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,5221815002844296461,7789617704135205244,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2028 /prefetch:8
                                                            3⤵
                                                              PID:3240
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,5221815002844296461,7789617704135205244,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:2
                                                              3⤵
                                                                PID:3308
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1604,5221815002844296461,7789617704135205244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:8
                                                                3⤵
                                                                  PID:2120
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,5221815002844296461,7789617704135205244,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
                                                                  3⤵
                                                                    PID:4824
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,5221815002844296461,7789617704135205244,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:1
                                                                    3⤵
                                                                      PID:4680
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,5221815002844296461,7789617704135205244,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
                                                                      3⤵
                                                                        PID:4912
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:3748
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                    • Enumerates system info in registry
                                                                    • Modifies registry class
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2788
                                                                  • C:\Windows\system32\rundll32.exe
                                                                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
                                                                    1⤵
                                                                      PID:2312
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                                                                      1⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2316
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                      1⤵
                                                                        PID:2976
                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                        1⤵
                                                                          PID:4616
                                                                        • C:\Windows\System32\rundll32.exe
                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                          1⤵
                                                                            PID:848
                                                                          • C:\Windows\system32\OpenWith.exe
                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                            1⤵
                                                                              PID:4372
                                                                              • C:\Windows\system32\NOTEPAD.EXE
                                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\osbaseln.dll
                                                                                2⤵
                                                                                • Opens file in notepad (likely ransom note)
                                                                                PID:3840
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:4852

                                                                              Network

                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                              Initial Access

                                                                              Execution

                                                                              Persistence

                                                                              Registry Run Keys / Startup Folder

                                                                              3
                                                                              T1060

                                                                              Privilege Escalation

                                                                              Defense Evasion

                                                                              Modify Registry

                                                                              3
                                                                              T1112

                                                                              File Permissions Modification

                                                                              1
                                                                              T1222

                                                                              Credential Access

                                                                              Discovery

                                                                              Query Registry

                                                                              5
                                                                              T1012

                                                                              Peripheral Device Discovery

                                                                              2
                                                                              T1120

                                                                              System Information Discovery

                                                                              4
                                                                              T1082

                                                                              Lateral Movement

                                                                              Collection

                                                                              Exfiltration

                                                                              Command and Control

                                                                              Impact

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\HookDLL.dll
                                                                                Filesize

                                                                                15KB

                                                                                MD5

                                                                                b2ca1151f83573bc172ddaa172f20c3d

                                                                                SHA1

                                                                                1d1f37de1726055f2f4f7e04fb40ba16404776ba

                                                                                SHA256

                                                                                448a89afddb9bfd9d19efed398d9102a8e80405ff720d9562b5e2ba2a36bfbf3

                                                                                SHA512

                                                                                c146e9389fcb66553db632d48a9fb76253f6c52a2037547a242d5b31fa55cebb72f5554257b2fd58639896f3df08985a66dfd76c35ef4103db5b7e2c0a7c8d1b

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                Filesize

                                                                                40B

                                                                                MD5

                                                                                13ee140d3fbdbfa1b149bedee8c79537

                                                                                SHA1

                                                                                da770b1f8b8024e6afe6ebdb0ec70eefd89756cf

                                                                                SHA256

                                                                                fa234ff7d82cbbd4fd290bb9d56438f5ab4771ac7ce47f293f0e3f442188d76c

                                                                                SHA512

                                                                                c368340fbe46f9caf4fa707c184c92d619ffdbda47967c0c62cfb6384dcf245611d814509e113f86c94fa8f8a59f5029f97263574a450dcdf1c568a656f2f975

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                                                                Filesize

                                                                                264KB

                                                                                MD5

                                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                                SHA1

                                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                SHA256

                                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                SHA512

                                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                2e1d24dcd9a3e7182ee773f3b0cc6593

                                                                                SHA1

                                                                                3f02cf355ffb1b66615d39401f34edae25c37e83

                                                                                SHA256

                                                                                098b84fa76a2bee2987bf11ed2d9de4ca6a19b949c072491613ffd3665d9e5f6

                                                                                SHA512

                                                                                df20dd3efa4f94f6132b663329b40015bd1807c81982f85e2991d9a0b8b99943faed15428cd6b1e29b113c78364183d002e0cce972057e9c423d75e453d7495f

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                Filesize

                                                                                27KB

                                                                                MD5

                                                                                8ba53939af9bf4d2c1aeb8e2a7b12b4e

                                                                                SHA1

                                                                                084d9c06e04ede65238f01346bbe9de9c00fadc8

                                                                                SHA256

                                                                                bc8afb88fdc2d35e50c46fcb55817e41be4935d732b7998fe4e8d51420cd9ddc

                                                                                SHA512

                                                                                958eeaad4d22a807dd86cd6187604b1ffe47856446f6172733a53edf65dfb86267f0fd6f7197d949781fd621ffa2e5825d9c22d7e84555f3d87b99efbd29aff2

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13317854321811433
                                                                                Filesize

                                                                                669B

                                                                                MD5

                                                                                540535817a834497ed48bd4997466f01

                                                                                SHA1

                                                                                9931e1188b75f0c0a7600146c69bd7626a19e138

                                                                                SHA256

                                                                                fe3253e0bec7fb0382453ecec88e145de6f57c3f62219a4c78be0119a3a5df3c

                                                                                SHA512

                                                                                caf82757350fab1604800cf9e9d9b935b0e58a4f06d4c391f0023d841ab9c8d7db855f5df88fb45808a5795ca78b09cfa2961a840931e3cf76849f274f1dee01

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
                                                                                Filesize

                                                                                348B

                                                                                MD5

                                                                                7ae1c350317e8e6e6486ba04d9d087a6

                                                                                SHA1

                                                                                18e2c41db82a6c5b93b835e1b68051dc62833c49

                                                                                SHA256

                                                                                395ab1a46f270d404fce908dd40bb7f81bcf0a7f5aba7b5a34a64356faf4ce37

                                                                                SHA512

                                                                                b085162956afca48d36c29a0ac23a592cb0a74850d5225b160846daec4b440b5136262f4ee26ea4631b721655fdfa2d533e265efa5a99495195046e559e11041

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
                                                                                Filesize

                                                                                160B

                                                                                MD5

                                                                                de92ad90be6d3364745b2f73f4c3cf73

                                                                                SHA1

                                                                                9158681463bd30e5af4dda4baac81f93cedbda77

                                                                                SHA256

                                                                                0025a3e0d3b834401b3b5f820e1991ef7e810d9a4b8b6b579e6301c94e7031a0

                                                                                SHA512

                                                                                9e81cefc195439439f4b23ee7696309d7bc3c08e5b444d2abde26d2f12b2d3bcfd124fb9a2d40c6389e9f787741676fad366a2e9982674e7b931028c014d8a79

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
                                                                                Filesize

                                                                                321B

                                                                                MD5

                                                                                d52a31dfda648fa7a71cb71192b038a8

                                                                                SHA1

                                                                                c46f7356d9dde21ca1a6ab4402c7120db2fd1a7c

                                                                                SHA256

                                                                                bcb146ce4dc1148075490f8d5ff4eaa0f61ada25aac9cffbd3d66a494affede1

                                                                                SHA512

                                                                                ed4d8cfc12a98a5c37e93e50fbf69f99578f2f02f57cf15fff33161da6c0f1169654a4bbf649fec86914d49f91d2f7af0fd0eff84a1246a67865c02eff0560c1

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                Filesize

                                                                                13B

                                                                                MD5

                                                                                b63048c4e7e52c52053d25da30d9c5ab

                                                                                SHA1

                                                                                679a44d402f5ec24605719e06459f5a707989187

                                                                                SHA256

                                                                                389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

                                                                                SHA512

                                                                                e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                Filesize

                                                                                103KB

                                                                                MD5

                                                                                3947968e0b0e3a9aa6aae37d833da3e7

                                                                                SHA1

                                                                                c6169666a445bf0996f00a147e1d4cba8f33cfac

                                                                                SHA256

                                                                                8ea482d4f6dc59f68e1e0c90b6bbaa2d68581ef799ed64e88449f82d026d9e0a

                                                                                SHA512

                                                                                90189080d277bf1b976f169873c8137c47fec15036714a2c06be4581de30edda37b1c50d8a88140863342b954ddbae64a9f17c3271c39fa3b19bf7533a95c4e5

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
                                                                                Filesize

                                                                                264KB

                                                                                MD5

                                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                                SHA1

                                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                SHA256

                                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                SHA512

                                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                Filesize

                                                                                391KB

                                                                                MD5

                                                                                66996a076065ebdcdac85ff9637ceae0

                                                                                SHA1

                                                                                4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce

                                                                                SHA256

                                                                                16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa

                                                                                SHA512

                                                                                e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                Filesize

                                                                                391KB

                                                                                MD5

                                                                                66996a076065ebdcdac85ff9637ceae0

                                                                                SHA1

                                                                                4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce

                                                                                SHA256

                                                                                16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa

                                                                                SHA512

                                                                                e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                Filesize

                                                                                997KB

                                                                                MD5

                                                                                3f8f18c9c732151dcdd8e1d8fe655896

                                                                                SHA1

                                                                                222cc49201aa06313d4d35a62c5d494af49d1a56

                                                                                SHA256

                                                                                709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331

                                                                                SHA512

                                                                                398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                Filesize

                                                                                997KB

                                                                                MD5

                                                                                3f8f18c9c732151dcdd8e1d8fe655896

                                                                                SHA1

                                                                                222cc49201aa06313d4d35a62c5d494af49d1a56

                                                                                SHA256

                                                                                709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331

                                                                                SHA512

                                                                                398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                                                                Filesize

                                                                                73KB

                                                                                MD5

                                                                                81e5c8596a7e4e98117f5c5143293020

                                                                                SHA1

                                                                                45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

                                                                                SHA256

                                                                                7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

                                                                                SHA512

                                                                                05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                                                                Filesize

                                                                                73KB

                                                                                MD5

                                                                                81e5c8596a7e4e98117f5c5143293020

                                                                                SHA1

                                                                                45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

                                                                                SHA256

                                                                                7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

                                                                                SHA512

                                                                                05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\KillAgent.bat
                                                                                Filesize

                                                                                161B

                                                                                MD5

                                                                                ea7df060b402326b4305241f21f39736

                                                                                SHA1

                                                                                7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

                                                                                SHA256

                                                                                e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

                                                                                SHA512

                                                                                3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

                                                                                Download Submit
                                                                              • C:\Users\Admin\AppData\Local\Temp\TakeOwn.bat
                                                                                Filesize

                                                                                46B

                                                                                MD5

                                                                                f80e36cd406022944558d8a099db0fa7

                                                                                SHA1

                                                                                fd7e93ca529ed760ff86278fbfa5ba0496e581ce

                                                                                SHA256

                                                                                7b41e5a6c2dd92f60c38cb4fe09dcbe378c3e99443f7baf079ece3608497bdc7

                                                                                SHA512

                                                                                436e711ede85a02cd87ea312652ddbf927cf8df776448326b1e974d0a3719a9535952f4d3cc0d3cd4e3551b57231d7e916f317b119ab670e5f47284a90ab59a2

                                                                                Download Submit
                                                                              • C:\Windows\SysWOW64\MSVCP50.dll
                                                                                Filesize

                                                                                552KB

                                                                                MD5

                                                                                497fd4a8f5c4fcdaaac1f761a92a366a

                                                                                SHA1

                                                                                81617006e93f8a171b2c47581c1d67fac463dc93

                                                                                SHA256

                                                                                91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                                SHA512

                                                                                73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                                Download Submit
                                                                              • C:\Windows\SysWOW64\msvcp50.dll
                                                                                Filesize

                                                                                552KB

                                                                                MD5

                                                                                497fd4a8f5c4fcdaaac1f761a92a366a

                                                                                SHA1

                                                                                81617006e93f8a171b2c47581c1d67fac463dc93

                                                                                SHA256

                                                                                91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                                SHA512

                                                                                73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                                Download Submit
                                                                              • C:\Windows\SysWOW64\msvcp50.dll
                                                                                Filesize

                                                                                552KB

                                                                                MD5

                                                                                497fd4a8f5c4fcdaaac1f761a92a366a

                                                                                SHA1

                                                                                81617006e93f8a171b2c47581c1d67fac463dc93

                                                                                SHA256

                                                                                91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                                SHA512

                                                                                73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                                Download Submit
                                                                              • C:\Windows\lhsp\tv\tv_enua.dll
                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                ed98e67fa8cc190aad0757cd620e6b77

                                                                                SHA1

                                                                                0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                                SHA256

                                                                                e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                                SHA512

                                                                                ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                                Download Submit
                                                                              • C:\Windows\lhsp\tv\tv_enua.dll
                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                ed98e67fa8cc190aad0757cd620e6b77

                                                                                SHA1

                                                                                0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                                SHA256

                                                                                e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                                SHA512

                                                                                ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                                Download Submit
                                                                              • C:\Windows\lhsp\tv\tv_enua.dll
                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                ed98e67fa8cc190aad0757cd620e6b77

                                                                                SHA1

                                                                                0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                                SHA256

                                                                                e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                                SHA512

                                                                                ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                                Download Submit
                                                                              • C:\Windows\lhsp\tv\tvenuax.dll
                                                                                Filesize

                                                                                40KB

                                                                                MD5

                                                                                1587bf2e99abeeae856f33bf98d3512e

                                                                                SHA1

                                                                                aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

                                                                                SHA256

                                                                                c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

                                                                                SHA512

                                                                                43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

                                                                                Download Submit
                                                                              • C:\Windows\lhsp\tv\tvenuax.dll
                                                                                Filesize

                                                                                40KB

                                                                                MD5

                                                                                1587bf2e99abeeae856f33bf98d3512e

                                                                                SHA1

                                                                                aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

                                                                                SHA256

                                                                                c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

                                                                                SHA512

                                                                                43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentCtl.dll
                                                                                Filesize

                                                                                160KB

                                                                                MD5

                                                                                237e13b95ab37d0141cf0bc585b8db94

                                                                                SHA1

                                                                                102c6164c21de1f3e0b7d487dd5dc4c5249e0994

                                                                                SHA256

                                                                                d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

                                                                                SHA512

                                                                                9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentCtl.dll
                                                                                Filesize

                                                                                160KB

                                                                                MD5

                                                                                237e13b95ab37d0141cf0bc585b8db94

                                                                                SHA1

                                                                                102c6164c21de1f3e0b7d487dd5dc4c5249e0994

                                                                                SHA256

                                                                                d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

                                                                                SHA512

                                                                                9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentDP2.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                a334bbf5f5a19b3bdb5b7f1703363981

                                                                                SHA1

                                                                                6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                                SHA256

                                                                                c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                                SHA512

                                                                                1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentDPv.dll
                                                                                Filesize

                                                                                64KB

                                                                                MD5

                                                                                7c5aefb11e797129c9e90f279fbdf71b

                                                                                SHA1

                                                                                cb9d9cbfbebb5aed6810a4e424a295c27520576e

                                                                                SHA256

                                                                                394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

                                                                                SHA512

                                                                                df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentDPv.dll
                                                                                Filesize

                                                                                64KB

                                                                                MD5

                                                                                7c5aefb11e797129c9e90f279fbdf71b

                                                                                SHA1

                                                                                cb9d9cbfbebb5aed6810a4e424a295c27520576e

                                                                                SHA256

                                                                                394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

                                                                                SHA512

                                                                                df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentDp2.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                a334bbf5f5a19b3bdb5b7f1703363981

                                                                                SHA1

                                                                                6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                                SHA256

                                                                                c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                                SHA512

                                                                                1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentDp2.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                a334bbf5f5a19b3bdb5b7f1703363981

                                                                                SHA1

                                                                                6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                                SHA256

                                                                                c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                                SHA512

                                                                                1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentMPx.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                4fbbaac42cf2ecb83543f262973d07c0

                                                                                SHA1

                                                                                ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                                SHA256

                                                                                6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                                SHA512

                                                                                4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentMPx.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                4fbbaac42cf2ecb83543f262973d07c0

                                                                                SHA1

                                                                                ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                                SHA256

                                                                                6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                                SHA512

                                                                                4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentMPx.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                4fbbaac42cf2ecb83543f262973d07c0

                                                                                SHA1

                                                                                ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                                SHA256

                                                                                6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                                SHA512

                                                                                4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentPsh.dll
                                                                                Filesize

                                                                                36KB

                                                                                MD5

                                                                                b4ac608ebf5a8fdefa2d635e83b7c0e8

                                                                                SHA1

                                                                                d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

                                                                                SHA256

                                                                                8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

                                                                                SHA512

                                                                                2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentPsh.dll
                                                                                Filesize

                                                                                36KB

                                                                                MD5

                                                                                b4ac608ebf5a8fdefa2d635e83b7c0e8

                                                                                SHA1

                                                                                d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

                                                                                SHA256

                                                                                8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

                                                                                SHA512

                                                                                2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentSR.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                9fafb9d0591f2be4c2a846f63d82d301

                                                                                SHA1

                                                                                1df97aa4f3722b6695eac457e207a76a6b7457be

                                                                                SHA256

                                                                                e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

                                                                                SHA512

                                                                                ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentSR.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                9fafb9d0591f2be4c2a846f63d82d301

                                                                                SHA1

                                                                                1df97aa4f3722b6695eac457e207a76a6b7457be

                                                                                SHA256

                                                                                e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

                                                                                SHA512

                                                                                ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentSvr.exe
                                                                                Filesize

                                                                                268KB

                                                                                MD5

                                                                                5c91bf20fe3594b81052d131db798575

                                                                                SHA1

                                                                                eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                                SHA256

                                                                                e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                                SHA512

                                                                                face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentSvr.exe
                                                                                Filesize

                                                                                268KB

                                                                                MD5

                                                                                5c91bf20fe3594b81052d131db798575

                                                                                SHA1

                                                                                eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                                SHA256

                                                                                e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                                SHA512

                                                                                face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                                Download Submit
                                                                              • C:\Windows\msagent\AgentSvr.exe
                                                                                Filesize

                                                                                268KB

                                                                                MD5

                                                                                5c91bf20fe3594b81052d131db798575

                                                                                SHA1

                                                                                eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                                SHA256

                                                                                e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                                SHA512

                                                                                face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                                Download Submit
                                                                              • C:\Windows\msagent\chars\Bonzi.acs
                                                                                Filesize

                                                                                5.0MB

                                                                                MD5

                                                                                1fd2907e2c74c9a908e2af5f948006b5

                                                                                SHA1

                                                                                a390e9133bfd0d55ffda07d4714af538b6d50d3d

                                                                                SHA256

                                                                                f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95

                                                                                SHA512

                                                                                8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171

                                                                                Download Submit
                                                                              • C:\Windows\msagent\intl\Agt0409.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                0cbf0f4c9e54d12d34cd1a772ba799e1

                                                                                SHA1

                                                                                40e55eb54394d17d2d11ca0089b84e97c19634a7

                                                                                SHA256

                                                                                6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

                                                                                SHA512

                                                                                bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

                                                                                Download Submit
                                                                              • C:\Windows\msagent\mslwvtts.dll
                                                                                Filesize

                                                                                52KB

                                                                                MD5

                                                                                316999655fef30c52c3854751c663996

                                                                                SHA1

                                                                                a7862202c3b075bdeb91c5e04fe5ff71907dae59

                                                                                SHA256

                                                                                ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

                                                                                SHA512

                                                                                5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

                                                                                Download Submit
                                                                              • C:\Windows\msagent\mslwvtts.dll
                                                                                Filesize

                                                                                52KB

                                                                                MD5

                                                                                316999655fef30c52c3854751c663996

                                                                                SHA1

                                                                                a7862202c3b075bdeb91c5e04fe5ff71907dae59

                                                                                SHA256

                                                                                ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

                                                                                SHA512

                                                                                5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

                                                                                Download Submit
                                                                              • \??\pipe\crashpad_3432_UURLRAKTYRKAWCQL
                                                                                MD5

                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                SHA1

                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                SHA256

                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                SHA512

                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                Download Submit
                                                                              • \??\pipe\crashpad_384_VHXFKYKGYWBAFJMK
                                                                                MD5

                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                SHA1

                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                SHA256

                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                SHA512

                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                Download Submit
                                                                              • memory/1100-143-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/1232-258-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/1324-137-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/1516-132-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/1812-261-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/2028-138-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/2228-177-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/2260-152-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/2316-239-0x0000029082640000-0x0000029082650000-memory.dmp
                                                                                Filesize

                                                                                64KB

                                                                                Download
                                                                              • memory/2316-240-0x0000029082740000-0x0000029082750000-memory.dmp
                                                                                Filesize

                                                                                64KB

                                                                                Download
                                                                              • memory/2424-164-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/2516-262-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/2608-270-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/2788-204-0x000001143BEBA000-0x000001143BEBD000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-254-0x000001143BF90000-0x000001143BF95000-memory.dmp
                                                                                Filesize

                                                                                20KB

                                                                                Download
                                                                              • memory/2788-211-0x000001143BEC0000-0x000001143BEC4000-memory.dmp
                                                                                Filesize

                                                                                16KB

                                                                                Download
                                                                              • memory/2788-210-0x000001143BEC0000-0x000001143BEC4000-memory.dmp
                                                                                Filesize

                                                                                16KB

                                                                                Download
                                                                              • memory/2788-216-0x000001143BED2000-0x000001143BED5000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-215-0x000001143BED2000-0x000001143BED5000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-214-0x000001143BED2000-0x000001143BED5000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-220-0x000001143BED6000-0x000001143BED9000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-222-0x000001143BED6000-0x000001143BED9000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-219-0x000001143BED6000-0x000001143BED9000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-228-0x000001143BED9000-0x000001143BEDC000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-227-0x000001143BED9000-0x000001143BEDC000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-226-0x000001143BED9000-0x000001143BEDC000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-233-0x000001143BF3E000-0x000001143BF41000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-234-0x000001143BF3E000-0x000001143BF41000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-235-0x000001143BF3E000-0x000001143BF41000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-208-0x000001143BEC0000-0x000001143BEC4000-memory.dmp
                                                                                Filesize

                                                                                16KB

                                                                                Download
                                                                              • memory/2788-207-0x000001143BEC0000-0x000001143BEC4000-memory.dmp
                                                                                Filesize

                                                                                16KB

                                                                                Download
                                                                              • memory/2788-242-0x000001143BF7B000-0x000001143BF7E000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-244-0x000001143BF7B000-0x000001143BF7E000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-243-0x000001143BF7B000-0x000001143BF7E000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-247-0x000001143BF88000-0x000001143BF8B000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-248-0x000001143BF88000-0x000001143BF8B000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-249-0x000001143BF88000-0x000001143BF8B000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-251-0x000001143BF90000-0x000001143BF95000-memory.dmp
                                                                                Filesize

                                                                                20KB

                                                                                Download
                                                                              • memory/2788-252-0x000001143BF90000-0x000001143BF95000-memory.dmp
                                                                                Filesize

                                                                                20KB

                                                                                Download
                                                                              • memory/2788-253-0x000001143BF90000-0x000001143BF95000-memory.dmp
                                                                                Filesize

                                                                                20KB

                                                                                Download
                                                                              • memory/2788-209-0x000001143BEC0000-0x000001143BEC4000-memory.dmp
                                                                                Filesize

                                                                                16KB

                                                                                Download
                                                                              • memory/2788-255-0x000001143BF90000-0x000001143BF95000-memory.dmp
                                                                                Filesize

                                                                                20KB

                                                                                Download
                                                                              • memory/2788-256-0x000001143BF90000-0x000001143BF95000-memory.dmp
                                                                                Filesize

                                                                                20KB

                                                                                Download
                                                                              • memory/2788-202-0x000001143BEBA000-0x000001143BEBD000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-205-0x000001143BEBA000-0x000001143BEBD000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-195-0x000001143ADD0000-0x000001143ADF0000-memory.dmp
                                                                                Filesize

                                                                                128KB

                                                                                Download
                                                                              • memory/2788-203-0x000001143BEBA000-0x000001143BEBD000-memory.dmp
                                                                                Filesize

                                                                                12KB

                                                                                Download
                                                                              • memory/2788-201-0x0000010C39D90000-0x0000010C39D98000-memory.dmp
                                                                                Filesize

                                                                                32KB

                                                                                Download
                                                                              • memory/2788-196-0x000001143B900000-0x000001143B920000-memory.dmp
                                                                                Filesize

                                                                                128KB

                                                                                Download
                                                                              • memory/2864-269-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3032-260-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3240-265-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3356-161-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3424-149-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3672-146-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3840-267-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3864-167-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/3924-155-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4064-134-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4072-264-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4088-180-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4272-158-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4432-172-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4844-266-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4884-168-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4896-136-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4924-268-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/4988-135-0x0000000000000000-mapping.dmp
                                                                                Download
                                                                              • memory/5104-263-0x0000000000000000-mapping.dmp
                                                                                Download