Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

VEGAS Pro ....1.dll

windows7-x64

3

VEGAS Pro ....1.dll

windows10-2004-x64

3

VEGAS Pro ...80.exe

windows7-x64

1

VEGAS Pro ...80.exe

windows10-2004-x64

1

VEGAS Pro ...up.exe

windows7-x64

1

VEGAS Pro ...up.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    664s
  • max time network
    699s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2023, 10:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VEGAS Pro 18/Setup.exe

  • Size

    693.2MB

  • MD5

    1afd68147ac485753917930116210a40

  • SHA1

    8c8deec48a8a7c3d4e5af8e26e8b3d09decad08b

  • SHA256

    3988557312ceca76bee86e2df0c34f2cdc7b2dc370846ba8390ae1d36d61e900

  • SHA512

    4cd02d60b7f30c7b5e08e312330342c124c9fb4cda01ba99e8d765a4040ee7832760a25c1d9e32a5e5a3a4521a4bd2c2a75a6b48395f32da1959f2117dadeacb

  • SSDEEP

    12582912:bGbk9hNMUyBXnkRSuLBCF8WwX2VX0I/wY3jCMQRoMCb+RSGcYHqEtZF8:lM5XnVTSX2VX0I/fjCpob+RSGdx8

Score
10/10
discoverypersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\VEGAS\VEGAS Pro 18.0\VEGASCapture\LICENSES.chromium.html

Ransom Note
<!-- Generated by licenses.py; do not edit. --><!doctype html> <html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <title>Credits</title> <link rel="stylesheet" href="chrome://resources/css/text_defaults.css"> <style> body { background-color: white; font-size: 84%; max-width: 1020px; } .page-title { font-size: 164%; font-weight: bold; } .product { background-color: #c3d9ff; border-radius: 5px; margin-top: 16px; overflow: auto; padding: 2px; } .product .title { float: left; font-size: 110%; font-weight: bold; margin: 3px; } .product .homepage { color: blue; float: right; margin: 3px; text-align: right; } .product .homepage::before { content: " - "; } .product .show { color: blue; float: right; margin: 3px; text-align: right; text-decoration: underline; } .licence { background-color: #e8eef7; border-radius: 3px; clear: both; display: none; padding: 16px; } .licence h3 { margin-top: 0; } .licence pre { white-space: pre-wrap; } .dialog #print-link, .dialog .homepage { display: none; } input + label + div { display: none; } input + label::after { content: "show license"; cursor: pointer; } input:checked + label + div { display: block; } input:checked + label::after { content: "hide license"; cursor: pointer; } </style> </head> <body> <span class="page-title" style="float:left;">Credits</span> <a id="print-link" href="#" style="float:right;" hidden>Print</a> <div style="clear:both; overflow:auto;"><!-- Chromium <3s the following projects --> <div class="product"> <span class="title">Abseil</span> <span class="homepage"><a href="https://github.com/abseil/abseil-cpp">homepage</a></span> <input type="checkbox" hidden id="0"> <label class="show" for="0" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. </pre> </div> </div> <div class="product"> <span class="title">Accessibility Audit library, from Accessibility Developer Tools</span> <span class="homepage"><a href="https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js">homepage</a></span> <input type="checkbox" hidden id="1"> <label class="show" for="1" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original ver
Emails

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt
URLs

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

http://code.google.com/p/y2038

http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2

http://mozilla.org/MPL/2.0/

http://www.torchmobile.com/

https://cla.developers.google.com/clas

http://www.openssl.org/)"

https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS

http://www.opensource.apple.com/apsl/

http://www.mozilla.org/MPL/

http://www.apple.com/legal/guidelinesfor3rdparties.html

http://developer.intel.com/vtune/cbts/strmsimd/922down.htm

http://skal.planet-d.net/coding/dct.html

http://developer.intel.com/vtune/cbts/strmsimd/appnotes.htm

http://www.elecard.com/peter/idct.html

http://www.linuxvideo.org/mpeg2dec/

https://firebase.google.com/terms/analytics/

https://www.freetype.org

https://www.khronos.org/registry/

Extracted

Path

C:\\Rar.txt

Ransom Note
User's Manual ~~~~~~~~~~~~~ RAR 6.20 console version ~~~~~~~~~~~~~~~~~~~~~~~~ =-=-=-=-=-=-=-=-=-=-=-=-=-=- Welcome to the RAR Archiver! -=-=-=-=-=-=-=-=-=-=-=-=-=-= Introduction ~~~~~~~~~~~~ RAR is a console application allowing to manage archive files in command line mode. RAR provides compression, encryption, data recovery and many other functions described in this manual. RAR supports only RAR format archives, which have .rar file name extension by default. ZIP and other formats are not supported. Even if you specify .zip extension when creating an archive, it will still be in RAR format. Windows users may install WinRAR, which supports more archive types including RAR and ZIP formats. WinRAR provides both graphical user interface and command line mode. While console RAR and GUI WinRAR have the similar command line syntax, some differences exist. So it is recommended to use this rar.txt manual for console RAR (rar.exe in case of Windows version) and winrar.chm WinRAR help file for GUI WinRAR (winrar.exe). Configuration file ~~~~~~~~~~~~~~~~~~ RAR and UnRAR for Unix read configuration information from .rarrc file in a user's home directory (stored in HOME environment variable) or in /etc directory. RAR and UnRAR for Windows read configuration information from rar.ini file, placed in the same directory as the rar.exe file. This file can contain the following string: switches=<any RAR switches separated by spaces> For example: switches=-m5 -s It is also possible to specify separate switch sets for individual RAR commands using the following syntax: switches_<command>=<any RAR switches separated by spaces> For example: switches_a=-m5 -s switches_x=-o+ Environment variable ~~~~~~~~~~~~~~~~~~~~ Default parameters may be added to the RAR command line by establishing an environment variable "RAR". For instance, in Unix following lines may be added to your profile: RAR='-s -md1024' export RAR RAR will use this string as default parameters in the command line and will create "solid" archives with 1024 MB sliding dictionary size. RAR handles options with priority as following: command line switches highest priority switches in the RAR variable lower priority switches saved in configuration file lowest priority Log file ~~~~~~~~ If switch -ilog is specified in the command line or configuration file, RAR will write informational messages about errors encountered while processing archives into a log file. Read the switch -ilog description for more details. The file order list for solid archiving - rarfiles.lst ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rarfiles.lst contains a user-defined file list, which tells RAR the order in which to add files to a solid archive. It may contain file names, wildcards and special entry - $default. The default entry defines the place in order list for files not matched with other entries in this file. The comment character is ';'. In Windows this file should be placed in the same directory as RAR or in %APPDATA%\WinRAR directory, in Unix - to the user's home directory or in /etc. Tips to provide improved compression and speed of operation: - similar files should be grouped together in the archive; - frequently accessed files should be placed at the beginning. Normally masks placed nearer to the top of list have a higher priority, but there is an exception from this rule. If rarfiles.lst contains such two masks that all files matched by one mask are also matched by another, that mask which matches a smaller subset of file names will have higher priority regardless of its position in the list. For example, if you have *.cpp and f*.cpp masks, f*.cpp has a higher priority, so the position of 'filename.cpp' will be chosen according to 'f*.cpp', not '*.cpp'. RAR command line syntax ~~~~~~~~~~~~~~~~~~~~~~~ Syntax RAR <command> [ -<switches> ] <archive> [ <@listfiles...> ] [ <files...> ] [ <path_to_extract\> ] Description Command is a single character or string specifying an action to be performed by RAR. Switches are designed to modify the way RAR performs such action. Other parameters are archive name and files to be archived or extracted. Listfiles are plain text files containing names of files to process. File names must start at the first column. It is possible to put comments to the listfile after // characters. For example, you can create backup.lst containing the following strings: c:\work\doc\*.txt //backup text documents c:\work\image\*.bmp //backup pictures c:\work\misc and then run: rar a backup @backup.lst If you wish to read file names from stdin (standard input), specify the empty listfile name (just @). By default, console RAR uses the single byte encoding in list files, but it can be redefined with -sc<charset>l switch. You can specify both usual file names and list files in the same command line. If neither files nor listfiles are specified, then *.* is implied and RAR will process all files. path_to_extract includes the destination directory name followed by a path separator character. For example, it can be c:\dest\ in Windows or data/ in Unix. It specifies the directory to place extracted files in 'x' and 'e' commands. This directory is created by RAR if it does not exist yet. Alternatively it can be set with -op<path> switch. Many RAR commands, such as extraction, test or list, allow to use wildcards in archive name. If no extension is specified in archive mask, RAR assumes .rar, so * means all archives with .rar extension. If you need to process all archives without extension, use *. mask. *.* mask selects all files. Wildcards in archive name are not allowed when archiving and deleting. In Unix you need to enclose RAR command line parameters containing wildcards in single or double quotes to prevent their expansion by Unix shell. For example, this command will extract *.asm files from all *.rar archives in current directory: rar e '*.rar' '*.asm' Command could be any of the following: a Add files to archive. Examples: 1) add all *.hlp files from the current directory to the archive help.rar: rar a help *.hlp 2) archive all files from the current directory and subdirectories to 362000 bytes size solid, self-extracting volumes and add the recovery record to each volume: rar a -r -v362 -s -sfx -rr save Because no file names are specified, all files (*) are assumed. 3) as a special exception, if directory name is specified as an argument and if directory name does not include file masks and trailing path separator, the entire contents of the directory and all subdirectories will be added to the archive even if switch -r is not specified. The following command will add all files from the directory Bitmaps and its subdirectories to the RAR archive Pictures.rar: rar a Pictures.rar Bitmaps 4) if directory name includes the trailing path separator, normal rules apply and you need to specify switch -r to process its subdirectories. The following command will add all files from directory Bitmaps, but not from its subdirectories, because switch -r is not specified: rar a Pictures.rar Bitmaps\* c Add archive comment. Comments are displayed while the archive is being processed. Comment length is limited to 256 KB. Examples: rar c distrib.rar Also comments may be added from a file using -z[file] switch. The following command adds a comment from info.txt file: rar c -zinfo.txt dummy ch Change archive parameters. This command can be used with most of archive modification switches to modify archive parameters. It is especially convenient for switches like -cl, -cu, -tl, which do not have a dedicated command. It is not able to recompress, encrypt or decrypt archive data and it cannot merge or create volumes. If no switches are specified, 'ch' command just copies the archive data without modification. If used with -amr switch to restore the saved archive name and time, other archive modification switches are ignored. Example: Set archive time to latest file: rar ch -tl files.rar cw Write archive comment to specified file. Format of output file depends on -sc switch. If output file name is not specified, comment data will be sent to stdout. Examples: 1) rar cw arc comment.txt 2) rar cw -scuc arc unicode.txt 3) rar cw arc d Delete files from archive. If this command removes all files from archive, the empty archive is removed. e Extract files without archived paths. Extract files excluding their path component, so all files are created in the same destination directory. Use 'x' command if you wish to extract full pathnames. Example: rar e -or html.rar *.css css\ extract all *.css files from html.rar archive to 'css' directory excluding archived paths. Rename extracted files automatically in case several files have the same name. f Freshen files in archive. Updates archived files older than files to add. This command will not add new files to the archive. i[i|c|h|t]=<string> Find string in archives. Supports following optional parameters: i - case insensitive search (default); c - case sensitive search; h - hexadecimal search; t - use ANSI, UTF-8, UTF-16 and OEM (Windows only) character tables; If no parameters are specified, it is possible to use the simplified command syntax i<string> instead of i=<string> It is allowed to specify 't' modifier with other parameters, for example, ict=string performs case sensitive search using all mentioned above character tables. Examples: 1) rar "ic=first level" -r c:\*.rar *.txt Perform case sensitive search of "first level" string in *.txt files in *.rar archives on the disk c: 2) rar ih=f0e0aeaeab2d83e3a9 -r e:\texts\*.rar Search for hex string f0 e0 ae ae ab 2d 83 e3 a9 in rar archives in e:\texts directory. k Lock archive. RAR cannot modify locked archives, so locking important archives prevents their accidental modification by RAR. Such protection might be especially useful in case of RAR commands processing archives in groups. This command is not intended or able to prevent modification by other tools or willful third party. It implements a safety measure only for accidental data change by RAR. Example: rar k final.rar l[t[a],b] List archive contents [technical [all], bare]. 'l' command lists archived file attributes, size, date, time and name, one file per line. If file is encrypted, line starts from '*' character. 'lt' displays the detailed file information in multiline mode. This information includes file checksum value, host OS, compression options and other parameters. 'lta' provide the detailed information not only for files, but also for service headers like NTFS streams or file security data. 'lb' lists bare file names with path, one per line, without any additional information. You can use -v switch to list contents of all volumes in volume set: rar l -v vol.part1.rar Commands 'lt', 'lta' and 'lb' are equal to 'vt', 'vta' and 'vb' correspondingly. m[f] Move to archive [files only]. Moving files and directories results in the files and directories being erased upon successful completion of the packing operation. Directories will not be removed if 'f' modifier is used and/or '-ed' switch is applied. p Print file to stdout. Send unpacked file data to stdout. Informational messages are suppressed with this command, so they are not mixed with file data. r Repair archive. Archive repairing is performed in two stages. First, the damaged archive is searched for a recovery record (see 'rr' command). If archive contains the previously added recovery record and if damaged data area is continuous and smaller than error correction code size in recovery record, chance of successful archive reconstruction is high. When this stage has been completed, a new archive is created, named as fixed.arcname.rar, where 'arcname' is the original (damaged) archive name. If broken archive does not contain a recovery record or if archive is not completely recovered due to major damage, second stage is performed. During this stage only the archive structure is reconstructed and it is impossible to recover files which fail checksum validation, it is still possible, however, to recover undamaged files, which were inaccessible due to the broken archive structure. Mostly this is useful for non-solid archives. This stage is never efficient for archives with encrypted file headers, which can be repaired only if recovery record is present. When the second stage is completed, the reconstructed archive is saved as rebuilt.arcname.rar, where 'arcname' is the original archive name. By default, repaired archives are created in the current directory, but you can append an optional destpath\ parameter to specify another destination directory. Example: rar r buggy.rar c:\fixed\ repair buggy.rar and place the result to 'c:\fixed' directory. rc Reconstruct missing and damaged volumes using recovery volumes (.rev files). You need to specify any existing .rar or .rev volume as the archive name. Example: rar rc backup.part03.rar Read 'rv' command description for information about recovery volumes. rn Rename archived files. The command syntax is: rar rn <arcname> <srcname1> <destname1> ... <srcnameN> <destnameN> For example, the following command: rar rn data.rar readme.txt readme.bak info.txt info.bak will rename readme.txt to readme.bak and info.txt to info.bak in the

Extracted

Path

C:\\WhatsNew.txt

Ransom Note
WinRAR - What's new in the latest version Version 6.20 1. If "Autodetect passwords" option in "Organizer passwords" dialog is enabled and password matching a processing archive is present among saved passwords, it is applied automatically. This option is applicable only for archives in RAR 5.0 and ZIP formats, which allow to verify the password validity quickly. There is a minor chance of incorrect password detection for ZIP archives if stored passwords do not include a proper one. If encrypted ZIP archive extraction fails, you can try to disable this option, repeat extraction and enter a valid password manually. 2. If extraction command involves only a part of files in RAR archive, the additional archive analysis is performed when starting extraction. It helps to properly unpack file references even if reference source is not selected. It works for most of RAR archives except for volumes on multiple removable media and archives containing a very large number of references. Also in some cases such analysis may help to optimize the amount of processing data when extracting individual files from semi-solid archives created with -s<N> and -se switches. 3. "Save original archive name and time" option on "Options" page of archiving dialog allows to save the original archive name and creation time. If archive includes such saved name and time, they are displayed on "Info" page of "Show information" command and can be restored on "Options" page of same command. Restoring involves renaming an archive to original name and setting the saved time as the archive creation and modification time. Switch -ams or just -am together with archive modification commands can be used to save the archive name and time in the command line mode. These saved parameters are displayed in header of "l" and "v" commands output and can be restored with -amr switch combined with "ch" command, such as "rar ch -amr arc.rar". If -amr is specified, "ch" ignores other archive modification switches. 4. Faster RAR5 compression of poorly compressible data on modern CPUs with 8 or more execution threads. This applies to all methods except "Fastest", which performance remains the same. 5. "Repair" command efficiency is improved for shuffled data blocks in recovery record protected RAR5 archives. 6. If file size has grown after archiving when creating non-solid RAR volumes, such file is stored without compression regardless of volume number, provided that file isn't split between volumes. Previously it worked only for files in the first volume. 7. Added decompression of .zipx archives containing file references, provided that both reference source and target are selected and reference source precedes the target inside of archive. Typically, if .zipx archive includes file references, it is necessary to unpack the entire archive to extract references successfully. 8. Added decompression of .zst long range mode archives with dictionary exceeding 128 MB. Previously it was possible to decompress them only if dictionary was 128 MB or less. 9. If "Turn PC off", "Hibernate", "Sleep" or "Restart PC" archiving options are enabled in WinRAR, a prompt to confirm or cancel such power management action is displayed directly before starting it. If no selection was made by user for 30 seconds, the proposed action is confirmed and started automatically. This prompt is also displayed for -ioff switch in WinRAR command line, but not in console RAR command line. 10. Context menu in WinRAR file list provides "Open in internal viewer" command for archive files. It can be helpful if you wish to view the archive raw data in internal viewer. For example, to read an email archive with UUE attachments included. Usual "View" command always displays the archive contents. If file is recognized as UUE archive, "View" would show UUE attachments. 11. Recovery record size is displayed on "Archive" page of file properties invoked from Explorer context menu for archives in RAR5 format. Previously there was only "Present" instead of exact size for RAR5 archives. 12. When archiving from stdin with -si switch, RAR displays the current amount of read bytes as the progress indicator. 13. If wrong password is specified when adding files to encrypted solid RAR5 archive, a password will be requested again. Previous versions cancelled archiving in this case. 14. If both options "Test archived files" and "Clear attribute "Archive" after compressing" or their command line -t -ac equivalents are enabled when archiving, "Archive" attribute will be cleared only if test was completed successfully. Previously it was cleared even when test reported errors. 15. NoDrives value containing the bit mask to hide drives can be now read from "HKEY_CURRENT_USER\Software\WinRAR\Policy" Registry key, which allows to include it to winrar.ini if necessary. Its "Software\Microsoft\Windows\CurrentVersion\Policies" locations in HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE are also supported. Previously only "Software\Microsoft\Windows\CurrentVersion\Policies" in HKEY_CURRENT_USER was recognized. 16. Bugs fixed: a) archive modification commands could fail for some ZIP archives with file comments; b) fixed a memory leak when reading contents of .tar.bz2 archives; c) if source and resulting archive format is the same, the archive conversion command didn't set the original archive time to a newly created archive even if "Original archive time" option was selected in archiving parameters; d) if "Merge volumes contents" option in "Settings/File list" was turned on, the folder packed size in WinRAR file list could be less than expected when browsing a multivolume archive contents. It didn't include the packed size of file parts continuing from previous volume into calculation; e) even if "Set file security" extraction option was turned off by default, extraction commands in Explorer context menu still attempted to restore NTFS file security data; f) WinRAR could read data beyond the end of buffer and crash when unpacking files from specially crafted ZIP archive. We are thankful to Bakker working with Trend Micro Zero Day Initiative for letting us know about this bug. Version 6.11 1. Added support for Gz archives with large archive comments. Previously the extraction command failed to unpack gz archives if comment size exceeded 16 KB. 2. Archive comments in gz archives are displayed in the comment window and recognized by "Show information" command. Large comments are shown partially. Previous versions didn't display Gzip comments. 3. Reserved device names followed by file extension, such as aux.txt, are extracted as is in Windows 11 even without "Allow potentially incompatible names" option or -oni command line switch. Unlike previous Windows versions, Windows 11 treats such names as usual files. Device names without extension, such as aux, still require these options to be unpacked as is regardless of Windows version. 4. Switch -mes can be also used to suppress the password prompt and abort when adding files to encrypted solid archive. 5. Additional measures to prevent extracting insecure links are implemented. 6. Bugs fixed: a) if password exceeding 127 characters was entered when unpacking an encrypted archive with console RAR, text after 127th character could be erroneously recognized as user's input by different prompts issued later; b) wrong archived file time could be displayed in overwrite prompt when extracting a file from ZIP archive. It happened if such archive included extended file times and was created in another time zone. It didn't affect the actual file time, which was set properly upon extraction. Version 6.10 1. WinRAR can unpack contents of .zst and .zipx archives utilizing Zstandard algorithm. 2. Added support of Windows 11 Explorer context menus. Beginning from Windows 11, an application can add only a single top level command or submenu to Explorer context menu. If "Cascaded context menus" in "Integration settings" dialog is on, this single item is a submenu storing all necessary WinRAR commands. If this option is off, only one extraction command for archives and one archiving command for usual files are available. You can select these commands with "Context menu items..." button in "Integration settings" dialog. 3. "Legacy context menus" option in "Settings/Integration" dialog can be used in Windows 11 if WinRAR commands are missing in "Show more options" Windows legacy context menu or in context menus of third party file managers. If WinRAR commands are already present here, keep "Legacy context menus" option turned off to prevent duplicating them. This option is not available in Windows 10 and older. 4. Windows XP is not supported anymore. Minimum required operating system version is Windows Vista. 5. "Close" item is added to "When done" list on "Advanced" page of archiving dialog. It closes WinRAR window, when archiving is done. 6. "When done" list is added to "Options" page of extraction dialog. It allows to select an action like turning a computer off or closing WinRAR after completing extraction. 7. Switch -si can be used when extracting or testing to read archive data from stdin, such as: type docs.rar | rar x -si -o+ -pmypwd dummy docs\ Even though the archive name is ignored with this switch, an arbitrary dummy archive name has to specified in the command line. Operations requiring backward seeks are unavailable in this mode. It includes displaying archive comments, testing the recovery record, utilizing the quick open information, processing multivolume archives. Prompts requiring user interaction are not allowed. Use -o[+|-|r], -p<pwd> or -mes switches to suppress such prompts. 8. New -ep4<path> switch excludes the path prefix when archiving or extracting if this path is found in the beginning of archived name. Path is compared with names already prepared to store in archive, without drive letters and leading path separators. For example: rar a -ep4texts\books archive c:\texts\books\technical removes "text\books" from archived names, so they start from 'technical'. 9. New -mes switch skips encrypted files when extracting or testing. It replaces the former -p- switch. 10. New -op<path> switch sets the destination folder for 'x' and 'e' extraction commands. Unlike <path_to_extract\> command line parameter, this switch also accepts paths without trailing path separator character. 11. If 'p' command is used to print a file to stdout, informational messages are suppressed automatically to prevent them mixing with file data. 12. "Generate archive name by mask" option and switch -ag treat only first two 'M' characters after 'H' as minutes. Previously any amount of such characters was considered as minutes. It makes possible to place the time field before the date, like -agHHMM-DDMMYY. Previous versions considered all 'M' in this string as minutes. 13. Maximum allowed size of RAR5 recovery record is increased to 1000% of protected data size. Maximum number of RAR5 recovery volumes can be 10 times larger than protected RAR volumes. Previous WinRAR versions are not able to use the recovery record to repair broken archives if recovery record size exceeds 99%. Similarly, previous versions cannot use recovery volumes if their number is equal or larger than number of RAR volumes. 14. Warning is issued if entered password exceeds the allowed limit of 127 characters and is truncated. Previously such passwords had been truncated silently. 15. If archive includes reserved device names, the underscore character is inserted in the beginning of such names when extracting. For example, aux.txt is converted to _aux.txt. It is done to prevent compatibility problems with software unable to process such names. You can use "Allow potentially incompatible names" option in "Advanced" part of extraction dialog or command line -oni switch to avoid this conversion. 16. WinRAR attempts to reset the file cache before testing an archive. It helps to verify actual data written to disk instead of reading a cached copy. 17. Multiple -v<size> switches specifying different sizes for different volumes are now allowed also for ZIP archives: WinRAR a -v100k -v200k -v300k arcname.zip Previously multiple -v<size> switches were supported only for RAR archives. 18. Switches -sl<size> and -sm<size> can be used in WinRAR.exe command line mode when extracting archives in any supported formats, provided that such archive includes unpacked file sizes. Previously these switches could filter files by size only in RAR and ZIP archives. 19. Newer folder selection dialog is invoked when pressing "Browse" button in WinRAR "Settings/Paths" page, "Repair" and "Convert" commands, also as in few other similar places. Previously a simpler XP style folder selection dialog was opened. 20. When restoring from tray after completing an operation, WinRAR window is positioned under other opened windows, to not interfere with current user activities. 21. "650 MB CD" is removed and "2 GB volumes" is added to the list of predefined volume sizes in "Define volume sizes" dialog invoked from WinRAR "Settings/Compression". 22. "Rename" command selects the file name part up to the final dot. Previously it selected the entire name. 23. If SFX archive size exceeds 4 GB, an error message is issued during compression, immediately after exceeding this threshold. Previously this error was reported only after completing compression. Executables of such size cannot be started by Windows. 24. Command line -en switch is not supported anymore. It created RAR4 archives without the end of archive record. End of archive record permits to gracefully skip external data like digital signatures. 25. Bugs fixed: a) when editing a file inside of .rar or .zip archive, WinRAR created a new SFX archive instead of updating an existing archive if "Create SFX archive" option was set in the default compression profile; b) the total progress could be displayed incorrectly when using -oi, -f, -u switches or appropriate GUI options; c) "Find files" command with "Use all tables" option and command line "it" commands failed to find strings in UTF-16 encoding. Version 6.02 1. ZIP SFX module refuses to process SFX commands stored in archive comment if such comment is resided after beginning of Authenticode digital signature. It is done to prevent possible attacks with inclusion of ZIP archive into the signature body. We already prohibited
URLs

https

http

http://weirdsgn.com

http://icondesignlab.com

https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar

Signatures

  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 52 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 11 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VEGAS Pro 18\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\VEGAS Pro 18\Setup.exe"
    1⤵
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Windows\SYSTEM32\msiexec.exe
      "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\redist.msi" /quiet /norestart /Liwear "C:\Users\Admin\AppData\Roaming\Sony\msvcrt_redist_14022023-104545.log"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3996
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Registers COM server for autorun
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 43E44742F69A831612767DC1C62C3770
      2⤵
      • Loads dropped DLL
      PID:4036
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 43278A025B9DCADC323AF32271D93428
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe" Install "C:\Program Files\VEGAS\VEGAS Pro 18.0\bdmux\BdMuxServer.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 0 -NGENProcess 21c -Pipe 22c -Comment "NGen Worker Process"
          4⤵
            PID:4704
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 2ac -Pipe 2cc -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            PID:100
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 0 -NGENProcess 2d0 -Pipe 230 -Comment "NGen Worker Process"
            4⤵
              PID:3772
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2c4 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              PID:4984
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 2d4 -Comment "NGen Worker Process"
              4⤵
                PID:4968
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2f8 -Pipe 2c0 -Comment "NGen Worker Process"
                4⤵
                  PID:4440
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 30c -Pipe 2d0 -Comment "NGen Worker Process"
                  4⤵
                  • Drops file in Windows directory
                  PID:1304
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 308 -Pipe 314 -Comment "NGen Worker Process"
                  4⤵
                    PID:1276
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 308 -Pipe 300 -Comment "NGen Worker Process"
                    4⤵
                    • Drops file in Windows directory
                    PID:3896
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 320 -Pipe 318 -Comment "NGen Worker Process"
                    4⤵
                    • Drops file in Windows directory
                    PID:4756
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 304 -Pipe 30c -Comment "NGen Worker Process"
                    4⤵
                    • Drops file in Windows directory
                    PID:720
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2e4 -Pipe 304 -Comment "NGen Worker Process"
                    4⤵
                    • Drops file in Windows directory
                    PID:4032
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 324 -Pipe 33c -Comment "NGen Worker Process"
                    4⤵
                      PID:4764
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"
                      4⤵
                      • Drops file in Windows directory
                      PID:4212
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 32c -Comment "NGen Worker Process"
                      4⤵
                      • Drops file in Windows directory
                      PID:3588
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 324 -Comment "NGen Worker Process"
                      4⤵
                      • Drops file in Windows directory
                      PID:3956
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 334 -Pipe 2d8 -Comment "NGen Worker Process"
                      4⤵
                        PID:4664
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 320 -Pipe 334 -Comment "NGen Worker Process"
                        4⤵
                          PID:2044
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2ec -Comment "NGen Worker Process"
                          4⤵
                          • Drops file in Windows directory
                          PID:2164
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2ac -Pipe 2dc -Comment "NGen Worker Process"
                          4⤵
                          • Drops file in Windows directory
                          PID:940
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 2e8 -Comment "NGen Worker Process"
                          4⤵
                          • Drops file in Windows directory
                          PID:4392
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 0 -NGENProcess 330 -Pipe 2b8 -Comment "NGen Worker Process"
                          4⤵
                          • Drops file in Windows directory
                          PID:3108
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 2f4 -Comment "NGen Worker Process"
                          4⤵
                            PID:4456
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 330 -Comment "NGen Worker Process"
                            4⤵
                            • Drops file in Windows directory
                            PID:1276
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 340 -Comment "NGen Worker Process"
                            4⤵
                            • Drops file in Windows directory
                            PID:3176
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 320 -Comment "NGen Worker Process"
                            4⤵
                              PID:2188
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 340 -Pipe 2e4 -Comment "NGen Worker Process"
                              4⤵
                              • Drops file in Windows directory
                              PID:3680
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 34c -Pipe 2bc -Comment "NGen Worker Process"
                              4⤵
                                PID:5016
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 31c -Pipe 228 -Comment "NGen Worker Process"
                                4⤵
                                • Drops file in Windows directory
                                PID:2420
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 338 -Comment "NGen Worker Process"
                                4⤵
                                • Drops file in Windows directory
                                PID:4640
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 358 -Pipe 354 -Comment "NGen Worker Process"
                                4⤵
                                • Drops file in Windows directory
                                PID:5068
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 2f8 -Pipe 358 -Comment "NGen Worker Process"
                                4⤵
                                • Drops file in Windows directory
                                PID:3588
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 0 -NGENProcess 344 -Pipe 2a8 -Comment "NGen Worker Process"
                                4⤵
                                  PID:1856
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 340 -Pipe 348 -Comment "NGen Worker Process"
                                  4⤵
                                  • Drops file in Windows directory
                                  PID:4784
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 350 -Pipe 2f0 -Comment "NGen Worker Process"
                                  4⤵
                                    PID:2692
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 308 -Pipe 340 -Comment "NGen Worker Process"
                                    4⤵
                                    • Drops file in Windows directory
                                    PID:5000
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 350 -Pipe 2ac -Comment "NGen Worker Process"
                                    4⤵
                                    • Drops file in Windows directory
                                    PID:4452
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                PID:2820
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sffrgpnv_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:3704
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack1_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:3492
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack2_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:1132
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack3_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:2760
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfresfilter_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                PID:2112
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sftrkfx1_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:4532
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx1_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:3644
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx2_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:1420
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx3_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:1260
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\xpvinyl_x64.dll"
                                2⤵
                                • Loads dropped DLL
                                • Registers COM server for autorun
                                • Modifies registry class
                                PID:3656
                              • C:\Windows\syswow64\MsiExec.exe
                                "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBControl.dll"
                                2⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                PID:3768
                              • C:\Windows\syswow64\MsiExec.exe
                                "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBUI.dll"
                                2⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                PID:4172
                              • C:\Windows\syswow64\MsiExec.exe
                                "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\VEGAS\VEGAS Pro 18.0\x86\sfvstproxystubx86.dll"
                                2⤵
                                • Loads dropped DLL
                                PID:3612
                              • C:\Windows\System32\MsiExec.exe
                                "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\VEGAS\VEGAS Pro 18.0\sfvstwrap.dll"
                                2⤵
                                • Loads dropped DLL
                                PID:4796
                              • C:\Windows\System32\MsiExec.exe
                                C:\Windows\System32\MsiExec.exe -Embedding C7206D2E6E1315FD252FEA3621A379D4 E Global\MSI0000
                                2⤵
                                • Loads dropped DLL
                                PID:1048
                              • C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe
                                "C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe" /register /user 1085
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in System32 directory
                                • Modifies system certificate store
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:4544
                                • C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe
                                  "C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:452
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                              1⤵
                                PID:2120
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:4564
                                • C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe
                                  "C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4628
                                  • C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe
                                    "C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:1304
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                  1⤵
                                  • Enumerates system info in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:4548
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xc4,0x128,0x7fffcfac4f50,0x7fffcfac4f60,0x7fffcfac4f70
                                    2⤵
                                      PID:1188
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:2
                                      2⤵
                                        PID:628
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1944 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4188
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2340 /prefetch:8
                                        2⤵
                                          PID:1820
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
                                          2⤵
                                            PID:4588
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                                            2⤵
                                              PID:1860
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
                                              2⤵
                                                PID:2820
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
                                                2⤵
                                                  PID:456
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:8
                                                  2⤵
                                                    PID:2072
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:8
                                                    2⤵
                                                      PID:1996
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:8
                                                      2⤵
                                                        PID:1504
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2676
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4676 /prefetch:8
                                                        2⤵
                                                          PID:3664
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:8
                                                          2⤵
                                                            PID:1136
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4828 /prefetch:8
                                                            2⤵
                                                              PID:3392
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                                                              2⤵
                                                                PID:3996
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4596
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4664 /prefetch:8
                                                                2⤵
                                                                  PID:1984
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:8
                                                                  2⤵
                                                                    PID:4744
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
                                                                    2⤵
                                                                      PID:1316
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:8
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3684
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 /prefetch:8
                                                                      2⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4732
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
                                                                      2⤵
                                                                        PID:3892
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=844 /prefetch:1
                                                                        2⤵
                                                                          PID:3848
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
                                                                          2⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5068
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                                                          2⤵
                                                                            PID:4224
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                                                                            2⤵
                                                                              PID:1412
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
                                                                              2⤵
                                                                                PID:1136
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
                                                                                2⤵
                                                                                  PID:2868
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                                                                                  2⤵
                                                                                    PID:3052
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2572
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4532
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3652
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5804 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4388
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6744 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1712
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6732 /prefetch:8
                                                                                              2⤵
                                                                                                PID:2980
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5776 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:4360
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:3540
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:4992
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:996
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:4732
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:3028
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5432 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:4424
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6060 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:424
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6284 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:4940
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:1372
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:3596
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:3188
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5924 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:1308
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:4216
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
                                                                                                                        2⤵
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:4596
                                                                                                                      • C:\Users\Admin\Downloads\winrar-x64-620.exe
                                                                                                                        "C:\Users\Admin\Downloads\winrar-x64-620.exe"
                                                                                                                        2⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2288
                                                                                                                        • C:\uninstall.exe
                                                                                                                          "C:\uninstall.exe" /setup
                                                                                                                          3⤵
                                                                                                                          • Modifies system executable filetype association
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Registers COM server for autorun
                                                                                                                          • Modifies registry class
                                                                                                                          PID:2760
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6592 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:2664
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:2
                                                                                                                          2⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:2112
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6552 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:3644
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:3092
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6272 /prefetch:8
                                                                                                                              2⤵
                                                                                                                                PID:4940
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:3188
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:2432
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3160 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:688
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6544 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:3804
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:4212
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:404
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6384 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                            PID:4728
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                              PID:4884
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:4980
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                PID:3996
                                                                                                                                              • C:\WinRAR.exe
                                                                                                                                                "C:\WinRAR.exe" "C:\Users\Admin\Downloads\VEGAS Pro 18.rar"
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:840
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:4744
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4808 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4592
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6500 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                      PID:100
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,8948803730075305231,18258885536766735284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4180
                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1312
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:556
                                                                                                                                                          • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir556_1369885993\ChromeRecovery.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir556_1369885993\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={f085765a-7d64-4574-8a37-e02f3f43ca3d} --system
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2972
                                                                                                                                                        • C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe
                                                                                                                                                          "C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe"
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Modifies Control Panel
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4936
                                                                                                                                                          • C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe
                                                                                                                                                            "C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3776
                                                                                                                                                          • C:\Program Files\VEGAS\VEGAS Pro 18.0\x86\FileIOSurrogate.exe
                                                                                                                                                            "C:\Program Files\VEGAS\VEGAS Pro 18.0\x86\FileIOSurrogate.exe" 1033
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:3220
                                                                                                                                                          • C:\Program Files\VEGAS\VEGAS Pro 18.0\x86\sfvstserver.exe
                                                                                                                                                            "C:\Program Files\VEGAS\VEGAS Pro 18.0\x86\sfvstserver.exe" -Event MxVstServerEvent_4936 -Vendor "MAGIX" -Product "VEGAS Pro 18.0"
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:4728
                                                                                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                          C:\Windows\system32\AUDIODG.EXE 0x4a4 0x508
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4360

                                                                                                                                                          Network

                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\EULA_enu.rtf
                                                                                                                                                            Filesize

                                                                                                                                                            12KB

                                                                                                                                                            MD5

                                                                                                                                                            f837aad5657b429f561814f4742c1f84

                                                                                                                                                            SHA1

                                                                                                                                                            5f2449c578aed744a49e42a82c16495588797d6a

                                                                                                                                                            SHA256

                                                                                                                                                            47e73f90e0af59acafa197ed07e71cd8d6c45a26a3582012c0664a3eddd99638

                                                                                                                                                            SHA512

                                                                                                                                                            bf23df16b0823e7a4ec09fba830408a6cf79540176163a558c67cdc4ad1fa495864057f60882693a76959fbb41b08b516b47beeddb95cb603abd4dae8d76f615

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\redist.msi
                                                                                                                                                            Filesize

                                                                                                                                                            49.9MB

                                                                                                                                                            MD5

                                                                                                                                                            e6801cf002699ff8cfcd2b099fcefaeb

                                                                                                                                                            SHA1

                                                                                                                                                            37b58c13c284af48a2acfcc6875944bccebe00d5

                                                                                                                                                            SHA256

                                                                                                                                                            51363501212dae8bc9b33c8aec711271d311f2f360ebc620c20d36ed714995f9

                                                                                                                                                            SHA512

                                                                                                                                                            bed4d17102288fecc044fbace08b560d3597fca962ad0eebff6f094378870843904a7afeb6e7e790da2420414950e977e1ba4a0501c958abc1b8e5a040367ec1

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\Monitor3D.cab
                                                                                                                                                            Filesize

                                                                                                                                                            922KB

                                                                                                                                                            MD5

                                                                                                                                                            5bcd6a6e167ae358fa7de5e8ce5d497e

                                                                                                                                                            SHA1

                                                                                                                                                            bd321d42428190e03a5e6f53721caea38b41d46f

                                                                                                                                                            SHA256

                                                                                                                                                            94d23df4013482606390f5b2532c870e21cfe1b9177f566b47c7d28bfe92d19b

                                                                                                                                                            SHA512

                                                                                                                                                            80b7d0b34047fafb04a7d7ac815a34d222a7e31e3527b76f7a1a1be5485ceec479e0e5518d63131f7f0da6b7dfd58f9af263b23feeedec01d12588b95e24eac6

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\OFXFilters.cab
                                                                                                                                                            Filesize

                                                                                                                                                            3.1MB

                                                                                                                                                            MD5

                                                                                                                                                            1e7a33078135779ecf9e7878cce505c2

                                                                                                                                                            SHA1

                                                                                                                                                            31e6bf27a290c55cfa34c96b43e1bfaf0c20702d

                                                                                                                                                            SHA256

                                                                                                                                                            881528d4990af3ac3274dda21081585a38260f7700bb907ef60f98078dc88c13

                                                                                                                                                            SHA512

                                                                                                                                                            57e766d095aea18a9296155b85a2fdae6567d285003512db659324f50d6e8c3b636243c11c954ca2d27836fb862bc6a98f2a5d04c5aa2b19ebe2e72a705aa4e3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\ac3studioplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                            MD5

                                                                                                                                                            ddd0ad783e98df4e406afa6eb87d6b26

                                                                                                                                                            SHA1

                                                                                                                                                            c140cfe33cba8eeb55f6d448720f49e2809a295b

                                                                                                                                                            SHA256

                                                                                                                                                            f7ac37497b93b8c8f2d1e0dce2ada71ab08ebac623c31a2521e2bd3848a7918f

                                                                                                                                                            SHA512

                                                                                                                                                            6639c595c546f9d8295bbc4a44da205b6c1975c899d749177641670449abc6eafd62e8a699fc38f89c603c37477b697a113d3dd21ef07b850603848b1f5b1356

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\aifplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            MD5

                                                                                                                                                            034450693e67618dd3353199758a02d0

                                                                                                                                                            SHA1

                                                                                                                                                            8f7bd82c47e2d3ed7743f291144faac78338b570

                                                                                                                                                            SHA256

                                                                                                                                                            3fa579e04ae9832cae77eded7232283fc793d0dd168815d0f1e486a6850a993a

                                                                                                                                                            SHA512

                                                                                                                                                            c9c0633c5ac59df023bf97b3d3bc035669fb14ac0273a11e3c3d2cc3fefd9039a9932173ba073d9dfe316af9b5545dcfca93f88ad1ccf2d282b148c620b01c78

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\atracplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            527KB

                                                                                                                                                            MD5

                                                                                                                                                            09fa7f36e7f5444a863030c331c12926

                                                                                                                                                            SHA1

                                                                                                                                                            b275ce8795b60031391f80cf8fff2708e036be17

                                                                                                                                                            SHA256

                                                                                                                                                            72fff6844c6dcbf1cd510eeb3fd2580f5ac8f82498e13e4b5c3b76a825d4316e

                                                                                                                                                            SHA512

                                                                                                                                                            eb540025feed6d4a57e4117a1ec310a2da871ff156a2887b73dd743b7b98981f63327b05ab50618c6ed9816f7711d0c46d47fb65b9fe53a8ed08b85f10ec3d15

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\aviplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            355KB

                                                                                                                                                            MD5

                                                                                                                                                            69cc7216a2aff0690cc14d70f4e31362

                                                                                                                                                            SHA1

                                                                                                                                                            027b127130b1c0e1ab3378e4261ed979594bb96b

                                                                                                                                                            SHA256

                                                                                                                                                            01c50e59208d504f9c5926b929a0aa6ad8b02a5dc61141d6e9719067e5e056a4

                                                                                                                                                            SHA512

                                                                                                                                                            4fccf427f242609846c2fff5695063f737ce50b0a4cf323fb51832faea4a48e07c98d8c564a956eb09d0e3b7b45748f05dcdd0fc1e4a4bb4958466f0a0f58bd9

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\cddb.cab
                                                                                                                                                            Filesize

                                                                                                                                                            742KB

                                                                                                                                                            MD5

                                                                                                                                                            f507dd458568b422a08e065503310e06

                                                                                                                                                            SHA1

                                                                                                                                                            296abfcd40d7d3065268b04aaae72889a80ba7dd

                                                                                                                                                            SHA256

                                                                                                                                                            8c02e481770497824a72fd3b3549dfcc21fa8ee0e1a2f645e8d0278d3d2c60f8

                                                                                                                                                            SHA512

                                                                                                                                                            4a0441c69b7e3c341746a1e78ad7b6e44865e7cc670d2ab6cc8a715d3b53b393c951dfbe83a70e3e0e95ae4180df37d8863e6187c7af6c50ac640a5567d4cf1c

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\errorreport.cab
                                                                                                                                                            Filesize

                                                                                                                                                            6.7MB

                                                                                                                                                            MD5

                                                                                                                                                            6b1f70a954748b02393d2021316789cb

                                                                                                                                                            SHA1

                                                                                                                                                            e0fb19813e61624d037898196d3e0ae1fd9d34dd

                                                                                                                                                            SHA256

                                                                                                                                                            a621f2cf23677a19c790577f5d4a049d3de5eb4024268dfcea39f563ba8bc753

                                                                                                                                                            SHA512

                                                                                                                                                            8984cfc04e4dbab8550e938cde51d7f7f8c6ea705a8bda2a2e0376e06564fab0f3a64354c05347995599e46787e92a6dfe00608b98a15ff1e2efa8a84525e143

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\exctrldr.cab
                                                                                                                                                            Filesize

                                                                                                                                                            11.0MB

                                                                                                                                                            MD5

                                                                                                                                                            8948b87b32e1782036d2d7b1abf3acd6

                                                                                                                                                            SHA1

                                                                                                                                                            52a6d343db02e965f037840d05b004c6b9a97afb

                                                                                                                                                            SHA256

                                                                                                                                                            d65fdb74efcbd271fd021b430414a7d1837b7ca6e6cd27bcee0e9872ffad5581

                                                                                                                                                            SHA512

                                                                                                                                                            844f1ed15122b57e6bf3e4f1878f67c1481d3c2799c34edb868fcce48ffac597f2e98c2c9b2c345fd1e69e61d45a598cdc8b86264b4dd7e1a803d2720becf729

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\extvid.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2.5MB

                                                                                                                                                            MD5

                                                                                                                                                            1b02be6464c5b77333860ce189ba8d2c

                                                                                                                                                            SHA1

                                                                                                                                                            286037eb03910d6a7a25f9618d9458040e670fe1

                                                                                                                                                            SHA256

                                                                                                                                                            5b1173cbe86c5ed15628796f6aa8f0ca767a982e5cc58a9d3702bd80e47915cd

                                                                                                                                                            SHA512

                                                                                                                                                            5b5fddb08e8dc1e8c64c5c6895b7eb07fa2046db79b5dddf069a3ff1e74120ea5a0f2c84e0c758ee476d08ef7d24d600b674c9fbff664235540498f9d5c8beba

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\extvid_aja.cab
                                                                                                                                                            Filesize

                                                                                                                                                            306KB

                                                                                                                                                            MD5

                                                                                                                                                            a92d425f7af1b7c64a0eebe09d492eea

                                                                                                                                                            SHA1

                                                                                                                                                            78374be2cb8956d39225dd78a419501ee33d434b

                                                                                                                                                            SHA256

                                                                                                                                                            fb0667908415dcf91bffdf8c2acda16048ccc139a3aceae7f7f2700075f4eef2

                                                                                                                                                            SHA512

                                                                                                                                                            34c5eb8f63c205825588e64384462834a5c72f68fd6f30b83863a0b2b6ceb09989fb4c6a7de1241bcbe1cbe9689fa0c33926a04de9ec698d8e3337d59f4bd5a5

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\extvid_decklink.cab
                                                                                                                                                            Filesize

                                                                                                                                                            803KB

                                                                                                                                                            MD5

                                                                                                                                                            f426b90f1fbc49473315d5214e51a8bd

                                                                                                                                                            SHA1

                                                                                                                                                            232d631a552b54a07eaf1a8773b26181c60b44dd

                                                                                                                                                            SHA256

                                                                                                                                                            e842465e8c741d7cc2d7a691e804d451f62fdd109da0f0505ca763779c41761f

                                                                                                                                                            SHA512

                                                                                                                                                            352459fd79a405cc0e8afbc823959d20478b2649e7d98262f882f5f21c820d3f3532e01706e5fa3eb5d7853290b70a0c176dd198a4f47c0a11baf6939a048f62

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\fileio.cab
                                                                                                                                                            Filesize

                                                                                                                                                            4.6MB

                                                                                                                                                            MD5

                                                                                                                                                            c5092228e8cbd1046af8965556814030

                                                                                                                                                            SHA1

                                                                                                                                                            b4bc6f046be6e534cc2a48fa1fb87d81a3986dab

                                                                                                                                                            SHA256

                                                                                                                                                            2e98ddff14f14fe71bb673751b202664f0b127c742a4187da763ddba550541db

                                                                                                                                                            SHA512

                                                                                                                                                            0f084daf64b1c370df3ee4c061845523b32abf2a4dbba1942a8646835255a291a4127fa2680afa7df89dd1cd89bef20b13575530dd96eabacd10939b12ec540e

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\fileiosurrogate.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.4MB

                                                                                                                                                            MD5

                                                                                                                                                            fa929cb3fd73e5bd508728c816a64ce5

                                                                                                                                                            SHA1

                                                                                                                                                            bc4cbb28b86daf56fa1c4ba952bedb086f5d9c63

                                                                                                                                                            SHA256

                                                                                                                                                            a41d0d7179eff616e1bebe014ff65562f42c4db18f707a27cbf4f26068200781

                                                                                                                                                            SHA512

                                                                                                                                                            d29522b803ed63274e2326d6a6d81cedf7dc886646874681278c7e76d783489c2e9f5880966c6946c908ea4a6bcb2074843ff7639e894edb17d628992b5e052d

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\flacplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            309KB

                                                                                                                                                            MD5

                                                                                                                                                            a3c97d14693fa9a433f81957a8cf3f4f

                                                                                                                                                            SHA1

                                                                                                                                                            bf4e919146992cb42e7fe11fa25fabd796916218

                                                                                                                                                            SHA256

                                                                                                                                                            40941492c774bb15051a7a2f8f4a6d861e951cd57c40f0bb33f8c5d1446a9d3e

                                                                                                                                                            SHA512

                                                                                                                                                            d65d0faa7b6f7c1141af6c71a47e15a2e9c6a5bcab90ba916cd5028182536ab8b1282b42546295bfdef368f629c3e49d9bc853610a05d1c46e6bd85ee3d35b6c

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\gifplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            54KB

                                                                                                                                                            MD5

                                                                                                                                                            adee6ca6a96a827a3026e0604eb6e00f

                                                                                                                                                            SHA1

                                                                                                                                                            849d6b2a32de5d157bcef59a8771067d7c0218db

                                                                                                                                                            SHA256

                                                                                                                                                            ff28c6ab201ff93412fe235c91ffdfd45a86362bd082533d047ee387cf6bc4c3

                                                                                                                                                            SHA512

                                                                                                                                                            2f5afcf053e296cb16ab7e6f0f4b3be98ace50174dbe14c049f3104103daffde56e6755759eb061dd4c38212efffaf9b7334fd0dad5dd73e31b5439dca5b76dc

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\imapi.cab
                                                                                                                                                            Filesize

                                                                                                                                                            838KB

                                                                                                                                                            MD5

                                                                                                                                                            b2bb0de58aafc9dc980dabf3d36551c8

                                                                                                                                                            SHA1

                                                                                                                                                            4bbd398342202656b037cdfb156b4967d9311b72

                                                                                                                                                            SHA256

                                                                                                                                                            66c985004edb1765516068b60e477ebe91d4d00bfe1697dde4530246b5b2ddcf

                                                                                                                                                            SHA512

                                                                                                                                                            9fa552965870c1844134168278c1c10eeccf8419cfb7c25d16cf49f54b1f004af81802cd5b85dcd4f7de202155a6cabd610a4a9d3a95f68a6c71bcdc36cfa5b6

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\joystick.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            5fee4e7cb96af2ada8ca385abe8eb415

                                                                                                                                                            SHA1

                                                                                                                                                            77f11b444be7bf6f1756e8770f9da8b2ce289b77

                                                                                                                                                            SHA256

                                                                                                                                                            70f6c803dd90c33302a9961544af414b6a5a08fdbf55f670252f3fc000fd03ef

                                                                                                                                                            SHA512

                                                                                                                                                            24dbe9e9a4b2f38cf380f1e055ae939d293d90d37b712de88cc481e0bd623bec438682294bb7d8a5b694a1e2c9bb5fb5f0d6978d13d3140c9dd2ec024502e536

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\layouts_vegas.cab
                                                                                                                                                            Filesize

                                                                                                                                                            3KB

                                                                                                                                                            MD5

                                                                                                                                                            932e86b3584b516ff25ec040027ac838

                                                                                                                                                            SHA1

                                                                                                                                                            3b4a867998fd4ac2cd77d84f2c36c68364005545

                                                                                                                                                            SHA256

                                                                                                                                                            9e6c11f3fe2fe294771c9495399cdd33463286e45259300a72d3c1e6eb01659b

                                                                                                                                                            SHA512

                                                                                                                                                            d70e7f2fa83d807435b30ac9dbefff7c7f5238853c3210c8306380ab3bc242f185d47f24dd70cd5fee724798001e5d093904b9abd520cae58ef42ae6b4dcc37b

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\log4net.cab
                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            MD5

                                                                                                                                                            b1048dca918ae1ec5a2358cd0309b272

                                                                                                                                                            SHA1

                                                                                                                                                            008a68adb6ab30dc103c8aaeb1dbc651be3925cc

                                                                                                                                                            SHA256

                                                                                                                                                            8eebce8fc808071cad07f9e241fc55cde8290edfa8ed6ac3cef4f12301719c49

                                                                                                                                                            SHA512

                                                                                                                                                            063e4cb329f35f397660f6ad11451e7ee20e5a3de2b7c0a837d6ff7e981d1391b3c8e7a28a3babee2bdf0c2820a94bd460de0815cb63c575f647878d2411e2c5

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\mchammer.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            cc0cf9299c3492c232a79fdd5c72677e

                                                                                                                                                            SHA1

                                                                                                                                                            a096b3dc402722ea68bee54e779f83743f9c55d6

                                                                                                                                                            SHA256

                                                                                                                                                            93962182e3a212a43a6cf2d7c1aeee5a6d8a1f2a86377d4be63a775c69fc84cd

                                                                                                                                                            SHA512

                                                                                                                                                            28b78ee8b96a8423327962a8ef8a807f5536e12768a93bfb662b0e2d56bef41a1a431d71f19df469ab7a62411942f409100e35446a0b9283c4e887ead4aec7af

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\mcplug2.cab
                                                                                                                                                            Filesize

                                                                                                                                                            5.4MB

                                                                                                                                                            MD5

                                                                                                                                                            36ec2c68aad12f2b0a656edf531f4f94

                                                                                                                                                            SHA1

                                                                                                                                                            da2177b426c3445d60d1e8c00a412db67c6dccba

                                                                                                                                                            SHA256

                                                                                                                                                            8a391aae8ffc5d0dfdd97b423583daa21b21408c665d8cd1c7d42ddb83e17f85

                                                                                                                                                            SHA512

                                                                                                                                                            9fff509a292def126ad5e46d95f8698a3e983e9990f5eb67d17399e3d282d767db6bb7d5c7dd4b506f9ac7bee7cb17c3d4700fc9ba44a2611606364ce9f38d21

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\mp3plug2.cab
                                                                                                                                                            Filesize

                                                                                                                                                            553KB

                                                                                                                                                            MD5

                                                                                                                                                            7811797e6276ce4fa437732fe59a6875

                                                                                                                                                            SHA1

                                                                                                                                                            89bf880976978d29257e5c5d1cb924ca0cf66d91

                                                                                                                                                            SHA256

                                                                                                                                                            5acd21c5420e4d77f47b3550d2e0977f29b679b6dc855045f2851d11e591d9af

                                                                                                                                                            SHA512

                                                                                                                                                            7996f7b5fea462febb44bef1adabba51ce8edb9dcbf94933e3fc9c606fded65090b0b9341b32938a24a04955089ac6f21ffc463dee5bd8502ce45fd347231a83

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\ngen.cab
                                                                                                                                                            Filesize

                                                                                                                                                            14KB

                                                                                                                                                            MD5

                                                                                                                                                            1c444923478ac477503276e9cbde010e

                                                                                                                                                            SHA1

                                                                                                                                                            0c95d5d89f2d7d41a4387fd3665ce92a98847663

                                                                                                                                                            SHA256

                                                                                                                                                            444b6a0995a16cd9cb5b84b9a5ab3c6773249e9af081a5d1372de051f21c1069

                                                                                                                                                            SHA512

                                                                                                                                                            5d77b8d03fe41eead6fe813249984169d604447aa6ed5d2b3a4584e242a6683c488a5ca2b3c6a87ec30f31fab36f10f35cabb78d5ac4342391163ef1dc90ba01

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\oggplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.8MB

                                                                                                                                                            MD5

                                                                                                                                                            2160af908fa3da38f5214652bc79eb9f

                                                                                                                                                            SHA1

                                                                                                                                                            0fbf51f368ec7d90d01335fe8e72588ba4484dcc

                                                                                                                                                            SHA256

                                                                                                                                                            fac164c94d0f4a86dec815159b6942cb41ffa12ec485c19c9552e960356f7b70

                                                                                                                                                            SHA512

                                                                                                                                                            c567201b1e912505ebf191cc83eadeca9b9d637ed166d260629c098ef7fdfd74504321561da0810d0450de553d4da2ae048f7df5be003ff34244fdfba78d3959

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\qt7plug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            454KB

                                                                                                                                                            MD5

                                                                                                                                                            1bd834cfda1bf770a4880ad40184e58d

                                                                                                                                                            SHA1

                                                                                                                                                            63b0a1af0a475a3eb6bb15a9a4df518501e2995a

                                                                                                                                                            SHA256

                                                                                                                                                            613f529f95d9a9f2a9d0b1b4c527edab4e411c15720348bf5562fd5dc5d7801d

                                                                                                                                                            SHA512

                                                                                                                                                            e47bbb611cee5442470095f12c8116b52e5d3e5cfc51518e8d67a679ed13e28664e471cf924aa5d0a3f4e08b7c9c5e9185ea6de72857d141f01a232fe7891add

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\readme_vegas.cab
                                                                                                                                                            Filesize

                                                                                                                                                            58KB

                                                                                                                                                            MD5

                                                                                                                                                            1897cbbb03a46fe81737e5f513903511

                                                                                                                                                            SHA1

                                                                                                                                                            f1113487157054836667cc8c0719b440a23e2dbe

                                                                                                                                                            SHA256

                                                                                                                                                            a5ee79e73a8d89ef76a1d402cd666d35e9ca398a2f972179bcb2123d5086b959

                                                                                                                                                            SHA512

                                                                                                                                                            0ecf30d3235b52b1e99c97d7e209c922136989777d235ba5f2a47c872f23eaa6d1ee824f6af7ec60ac08a2f85cb9908198accde064713bdc82b471673850ed22

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\redplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            7.2MB

                                                                                                                                                            MD5

                                                                                                                                                            c2471d461dad0397e321322e3532ec47

                                                                                                                                                            SHA1

                                                                                                                                                            5bf0338e633768f3114f2b7809baff711ff568ce

                                                                                                                                                            SHA256

                                                                                                                                                            a402e1ad66c069a5917362da6adb0a689271288e98ff2630088dd4eb81275380

                                                                                                                                                            SHA512

                                                                                                                                                            123cd1fd81beb7ec3635a262921eed9b824a0ffc27af6232910645a30921a79afc96f976e31675f730f1a4301f5c2285900bb6ec91475127061d334532c33c43

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\scripts.cab
                                                                                                                                                            Filesize

                                                                                                                                                            21KB

                                                                                                                                                            MD5

                                                                                                                                                            30a4e33914cfdec94038ee609f85f67b

                                                                                                                                                            SHA1

                                                                                                                                                            13f1318033e88e43c7ffe5c655d8c1678da33824

                                                                                                                                                            SHA256

                                                                                                                                                            d0c2b5839cbbeae0b67136bf11c2bb253fb02ca4e9206115e84b5faf5af5f197

                                                                                                                                                            SHA512

                                                                                                                                                            7191e5827e467b307bfe89453470abf5f4df48d2353018c9b26bd7e7e774b6b3a129f76d7eb16702ac746054b4ab0b94a9513b2ef3c9f85ebd941d109f741326

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sctplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            MD5

                                                                                                                                                            58efe8e18686538956f665bfb80db4b4

                                                                                                                                                            SHA1

                                                                                                                                                            0a703b7186214d19c2046aa3552ec51cd054379b

                                                                                                                                                            SHA256

                                                                                                                                                            06e3abf6fdaa037c128faf94c9cc6781d619fdfab2f5ce8910925f4eafb4ad26

                                                                                                                                                            SHA512

                                                                                                                                                            b0497d23e4d0890de4dc380a0bf92d8b847c02f97c63324494478836c52d594968b242d0fcdc7912b73e053f1bfbc30e3be6e387888df0b4aa2ee5fb1a785e59

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sffrgpnv.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.2MB

                                                                                                                                                            MD5

                                                                                                                                                            e97a61f59b5d9a9faa6cf950b6cb69e6

                                                                                                                                                            SHA1

                                                                                                                                                            536a9d80d5728068b7f60ddcb5fa4c754f7581e9

                                                                                                                                                            SHA256

                                                                                                                                                            313f87dbd4de26b236736c6364aa6eb6d7e486ec9dcb855f5e0c9de912640348

                                                                                                                                                            SHA512

                                                                                                                                                            c296dab03ef6d4e6426b59e08e560ef3d6ca010570fd427c253b22e8f091db14429092321d3b8a323bf60ebceb96362c3a95f7b09266a93914aee3dc845511e4

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfpaplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            MD5

                                                                                                                                                            91cc20ba424f606daa79f5a72284636d

                                                                                                                                                            SHA1

                                                                                                                                                            2420d65ba1c6d602c8dd20ef1438baa49bb7f1cf

                                                                                                                                                            SHA256

                                                                                                                                                            2ec8502a787062c61284065b9600428f89032fce8745bfc748623515266522cd

                                                                                                                                                            SHA512

                                                                                                                                                            9b7d0e136d4cbf414774c314cdcfc780088d93ebfd4e5ce5a98dbfa6f3befb7bc8cfe52558bc10c6b9373d6913a9769cf2f2377e41ee86aaacd535ef69aaf161

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfppack1.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            MD5

                                                                                                                                                            8a9c33b527c031ea38db9ab32e3346f0

                                                                                                                                                            SHA1

                                                                                                                                                            1e122a100fdca00c859783d26ecba86e0230c766

                                                                                                                                                            SHA256

                                                                                                                                                            eafa97e73c19cb532075b64a65dd5c79af5e9b7c12c35d70860d24c3449bb83d

                                                                                                                                                            SHA512

                                                                                                                                                            fe059ed1253b25c25f6b8713c9793e50f3326b1790ac646fe401588cf1d7e81bb5b819d412daf649b66d5884884a8a6c245c2fe6f58d4157484385e218a47663

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfppack2.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2.1MB

                                                                                                                                                            MD5

                                                                                                                                                            8b477059d3bb59d1b78d619e666ea971

                                                                                                                                                            SHA1

                                                                                                                                                            f69c1d8d8bbfe9a85feea80a10f4867331fee93c

                                                                                                                                                            SHA256

                                                                                                                                                            347fc982ab5aa0172da2551113791351f3eb7e4060eee69e1e763e99d825993e

                                                                                                                                                            SHA512

                                                                                                                                                            7f22f586d10ce3771d25cb2061cd73db32e9ac15bcd0f9d84fa3c2ed076c569afe260f0c619eecd406ba34074ed37cc9722917f2bc740e41c541914a2c579b2f

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfppack3.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.9MB

                                                                                                                                                            MD5

                                                                                                                                                            32d05310e05a1664d5abcdf220e4e63d

                                                                                                                                                            SHA1

                                                                                                                                                            151da26229e83b1114a2cc329cada299d0363900

                                                                                                                                                            SHA256

                                                                                                                                                            6e6c31a6e343c719e44974fb979b15ba23e09c809d92769e02241a68855a33a5

                                                                                                                                                            SHA512

                                                                                                                                                            83d06fef7c21530257032939ae68bfb348849283693d73cdc9b72be05f1a239e026045a4d36a526bc6e60a0bc8c235773976b64787b64193c5eb71e38f4dfc16

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfresfilter.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                            MD5

                                                                                                                                                            9f1b20a1b9d4390c2febeaf99ad9d2f6

                                                                                                                                                            SHA1

                                                                                                                                                            736a3bcd9bee05370dc52920a501d9fe183db984

                                                                                                                                                            SHA256

                                                                                                                                                            aa7cd77022b3f9f58efa44d0e3593b59f7f4f96d7e86a38bf38e212578fb1262

                                                                                                                                                            SHA512

                                                                                                                                                            bd5cf985afe7ca0e406a857b7d21e1001d91a3880c6d7df1b29f13da1b066e3936c5affc9a0a7a10d50dc4f79561593d3dcd364102a791edad41af3fecbf98c6

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sftrkfx1.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                            MD5

                                                                                                                                                            c28993b0a9852c054db55bb49b43e167

                                                                                                                                                            SHA1

                                                                                                                                                            acfe77c3c409fca4d4731b916de6c1b147107beb

                                                                                                                                                            SHA256

                                                                                                                                                            01b67095a92a093c78bc47b7669b68a68e6885a0f1f9afb749eabf3341b52e02

                                                                                                                                                            SHA512

                                                                                                                                                            7c59572529dec097492c6664791404246554f662ce7bf9ef899f0dd7d5e87b5123f1e8caf681eb8ff058d8cd05c0f08031a96a89319e025463c7fd83c0906008

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfvstwrap.cab
                                                                                                                                                            Filesize

                                                                                                                                                            3.1MB

                                                                                                                                                            MD5

                                                                                                                                                            2031c9b18d6adc2a6d9852f3b2a6a040

                                                                                                                                                            SHA1

                                                                                                                                                            2cfd3a91842e90018bacf74f44208db6b38a4fdc

                                                                                                                                                            SHA256

                                                                                                                                                            610f9bd1e8be637a0b0fe4618b91c2da0640a898dbd1ec829949790683e4e594

                                                                                                                                                            SHA512

                                                                                                                                                            bfa2e3f273b10f43db5bee509f85f597f095cf1361a749accb36269ff802dd9dd0fbced95b2ac5105e131b49caeba24830d353368ea81e5a7c39b4f710c908dc

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfxpfx1.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.4MB

                                                                                                                                                            MD5

                                                                                                                                                            e0bfb0bdcb2399bcba5bbd070590da1c

                                                                                                                                                            SHA1

                                                                                                                                                            98ee02157e74d488bc7280605ddd569054fce893

                                                                                                                                                            SHA256

                                                                                                                                                            c858df38b9d663fa667d537cd05bdd18278f12c4416bc50c1cde22705d19c951

                                                                                                                                                            SHA512

                                                                                                                                                            41194bb5893c259abc5c2c9620d81eb5ee85c8e66e6ac4e75b1a3ce1a3c99a9651c530d15f6eddde12920800c4bbc7e17f85413be8609e233241cbbdc2144389

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfxpfx2.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.2MB

                                                                                                                                                            MD5

                                                                                                                                                            350e0dcc10d0aea97526d001107cd511

                                                                                                                                                            SHA1

                                                                                                                                                            79e8eb921d2c294d7eff5fdda1de19291f80a3e0

                                                                                                                                                            SHA256

                                                                                                                                                            f0715826929340866430f414a640deed290ab6ab2e79750cb08bdd4fdaef9c01

                                                                                                                                                            SHA512

                                                                                                                                                            27e3b69e517f161bada5464fe2890610126c60bdc83a2a556545d5f0bb55e6a2afca1e10055b0bf6ab4fdb6d62508bd230a804f83f9dd7d37645005a31d1615a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sfxpfx3.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.3MB

                                                                                                                                                            MD5

                                                                                                                                                            8f594cddf3839a2285f69eba31f9c206

                                                                                                                                                            SHA1

                                                                                                                                                            cd66c1f9c6258c6bc2fc476f8d04409b28195a89

                                                                                                                                                            SHA256

                                                                                                                                                            714c80d2006d05f365d307d599f6053cb3e059214c37707b7c6a1d0d838df9a4

                                                                                                                                                            SHA512

                                                                                                                                                            5ae6982f54f14a20b7417d282018e1dfc3beca2049ea02dd92258606f29366b3927bf1457fb8105ccc4dd41d0b5a23fea67bbd563620ac051abd26de1a0d2031

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\shuttle_vegas.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            fbdd5c5d4936ffe3323603d931c4b909

                                                                                                                                                            SHA1

                                                                                                                                                            962fec19ee5ab2afb5c4a607b20498979251b674

                                                                                                                                                            SHA256

                                                                                                                                                            bb7397551440460eb4d6cc96407658f63dd7aefbf24f7dbf306009c390c3da28

                                                                                                                                                            SHA512

                                                                                                                                                            3dd716b37bd71cd277027e24a19370df902a72d50287375a94c56ac582c95adfeac950f3ec4e58f45dbb60bf609c8b59b2c5ab76f0b022eed0d84b185453bbfe

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\skins.cab
                                                                                                                                                            Filesize

                                                                                                                                                            35KB

                                                                                                                                                            MD5

                                                                                                                                                            e8311fb069e5de5db8608619e976300e

                                                                                                                                                            SHA1

                                                                                                                                                            e7bc847d6daaa80d152747e435dcce3178d4ff92

                                                                                                                                                            SHA256

                                                                                                                                                            09c41fc7d26fad24a59172081ebb20225bead2d57bc261ee2cd7d74a4df68f92

                                                                                                                                                            SHA512

                                                                                                                                                            d0e71e227af112be0ae069f24605667b3c17b46401d9284ae9885ebe075d709f57d27f026f27eea291c152fdb04ea7c13a60d9cd9c7842640a53063db933c598

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sonycapture.cab
                                                                                                                                                            Filesize

                                                                                                                                                            173KB

                                                                                                                                                            MD5

                                                                                                                                                            7d8648d89ec6e05e6c85b8ea2a91189d

                                                                                                                                                            SHA1

                                                                                                                                                            0468961920ffddbb3694c53508fe717726e83fcd

                                                                                                                                                            SHA256

                                                                                                                                                            4caf36595134e7a6967166c4ba3ef3aa2ee72d16add183260ca6f3d853c1c9cc

                                                                                                                                                            SHA512

                                                                                                                                                            7c8ce685c7d926163c1f5fcfcadc0e0b09e67a227776e963f05c81ca83a61f9bfb62e72414114c7d87d532adfc80a80584a165eae708d201652b7921a5a05812

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sonyclrshared.cab
                                                                                                                                                            Filesize

                                                                                                                                                            203KB

                                                                                                                                                            MD5

                                                                                                                                                            f7838e80060325551b3da5070f49f23e

                                                                                                                                                            SHA1

                                                                                                                                                            af180fdd5530b574940d5db142505018e2dfb5b4

                                                                                                                                                            SHA256

                                                                                                                                                            f7fac7742cfb4732acbbff5ccc233afd117b392d122a4218ef398d0d069f922a

                                                                                                                                                            SHA512

                                                                                                                                                            eba160747b00c8e76c4192416727ca2de3e67cc4d005da5875f0164b5c994a73ede8ce2cdbb29769232c7d51127b9da3376c6feaf771a018154378269adc1303

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sonydeviceexp.cab
                                                                                                                                                            Filesize

                                                                                                                                                            242KB

                                                                                                                                                            MD5

                                                                                                                                                            62b4eb166835fba71c18b50b3301ea63

                                                                                                                                                            SHA1

                                                                                                                                                            0fde0a4a9d14b5abb84ac8995fdc0fc5cfaea476

                                                                                                                                                            SHA256

                                                                                                                                                            51c01d31881a0ce38828633fda25d6127de75b591cb16052dc423386fbc7fec2

                                                                                                                                                            SHA512

                                                                                                                                                            fd58c7a44ca2dd76e9ed23858da8b150faad46f0b912cc60fe37c1c98f6ab14a00bab455f072aa520f3b3577e346d262660ca44fc829fe2bea46b86fb6391442

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sonyexternalviddev.cab
                                                                                                                                                            Filesize

                                                                                                                                                            206KB

                                                                                                                                                            MD5

                                                                                                                                                            b99f4e2844ce81592d85014ea5804213

                                                                                                                                                            SHA1

                                                                                                                                                            b2b15cb66752164fd514070974e36aaf3cc9efb3

                                                                                                                                                            SHA256

                                                                                                                                                            7251413ff0284780e5985941fafd50f76d90500206ef94755b39f4b2aa126942

                                                                                                                                                            SHA512

                                                                                                                                                            fc740f6684f4cb93c7d9348c9331957613b269048639c6316333c584dcdd71d6fdec42531aef204ba77966b9db6425899b6f4ef336fe467f529d2fc97120e243

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\sonyvegasdll.cab
                                                                                                                                                            Filesize

                                                                                                                                                            313KB

                                                                                                                                                            MD5

                                                                                                                                                            bca0d902616c837bf64db9bfc72dc967

                                                                                                                                                            SHA1

                                                                                                                                                            12e346a4125531a16f9d605aa87f7dad78d84945

                                                                                                                                                            SHA256

                                                                                                                                                            9039c56c15bde2f4a0a7b06f19210ec5daddaf8a82bcc0d711eac78fab9b9804

                                                                                                                                                            SHA512

                                                                                                                                                            18606ac5cfc71e2f6172014a5b7bb5ee3eec24f40ee915bb71beffd86df9a42c8af8072827a3ed191df0efa7722bf09f7758d5910c7a570bc0b7cf4b27d3b458

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\stl2plug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            MD5

                                                                                                                                                            8fd67c99522fc625857113e456a3103b

                                                                                                                                                            SHA1

                                                                                                                                                            fa4ec407b1a07c9980a6974ec1cd7dfd893d425e

                                                                                                                                                            SHA256

                                                                                                                                                            512dc207e60326f1d278b4e2f2acefac13ad1e379994d194d6908f202810e601

                                                                                                                                                            SHA512

                                                                                                                                                            228c18ab1a0734176193961be9f5008bc8ce7c74d05d292a37c41be1cb34a0a03a2aaa8b6c84e78e866bf71d5ce49d5573f04cc3fe1706dd0f3beb4199ee1172

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\tutor.cab
                                                                                                                                                            Filesize

                                                                                                                                                            35.3MB

                                                                                                                                                            MD5

                                                                                                                                                            7b33eca2ccd5fab1cf0b553ff42f65e8

                                                                                                                                                            SHA1

                                                                                                                                                            5347bb9b4dd1f8685d6239c08c9b0380c38b408c

                                                                                                                                                            SHA256

                                                                                                                                                            b07e4291acf328cffbcccb806050125b1d2e4f82c1ecb2b37c32b5b84d49fb4e

                                                                                                                                                            SHA512

                                                                                                                                                            ef5538eaa0418aca0ba40b9c532eef3df166979c0ba100da075d5ea35e1421973a9102b5941e940da36ded547645a98db9cf0c6ba470a6487d508778688d1a5d

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\vduplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.9MB

                                                                                                                                                            MD5

                                                                                                                                                            691d932f13ba1fe6622e39b60a4a89fc

                                                                                                                                                            SHA1

                                                                                                                                                            239bb2d1528ff2b8b8c854bea93da4d75089fda2

                                                                                                                                                            SHA256

                                                                                                                                                            302ce01c132ae917d7d78edf142ffed44a7135f0bf92ef5fa5d07625b7d45729

                                                                                                                                                            SHA512

                                                                                                                                                            e496a4467f9e4d8e814fa2a194f3651058bf6f943a8512d186b60cbb6f73a47b6e20869c8a2df2437d0d805ba017f66dc6377f8acf7fb22c466e62c2e9a4d89a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\vegas180.msi
                                                                                                                                                            Filesize

                                                                                                                                                            2.8MB

                                                                                                                                                            MD5

                                                                                                                                                            94a59313dd9592b79b3b03888167bbd0

                                                                                                                                                            SHA1

                                                                                                                                                            02f36fc109ddf9fd86924e88938410ea6f7eab2f

                                                                                                                                                            SHA256

                                                                                                                                                            30e1409e709335647a191c2a6310a5dd8909183577b8dc55168bb8d20fa71068

                                                                                                                                                            SHA512

                                                                                                                                                            7934b07f2ac3e04594c1235ac4ce72a09cd55d053c23c0ca39b42987cf65f6d3028cb10530e3c8bfcafd1f80fbb452ca899dd545291d8162d06aacafd496d839

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\vidcap.cab
                                                                                                                                                            Filesize

                                                                                                                                                            4.0MB

                                                                                                                                                            MD5

                                                                                                                                                            6a9851b06684cf9bdd1036b802e1b2ce

                                                                                                                                                            SHA1

                                                                                                                                                            98b4183f70e04e14e44a617e4588e77bd4200b37

                                                                                                                                                            SHA256

                                                                                                                                                            57cb9abbc0cdadbdfc10ac5f08be1ed598741659d2b9d971bb54a8ec0cba1d7c

                                                                                                                                                            SHA512

                                                                                                                                                            a8be128451ad39a3a63d41d67a4d496e8d6e367138486be1d3f16d42e952c33f6ca82b3e865ad2c63ad7e1710cd315ead03e3dbe129209410786783a2e75775e

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\wavplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            268KB

                                                                                                                                                            MD5

                                                                                                                                                            0f3cbc7561f9283deeede1e30dc23f5f

                                                                                                                                                            SHA1

                                                                                                                                                            b7d2ce377238b1fc86b53c69f551a31801c795cd

                                                                                                                                                            SHA256

                                                                                                                                                            3bf724745efa5cbc45db52300661e4c66049e770acb990b558aec2c0c028a9f5

                                                                                                                                                            SHA512

                                                                                                                                                            b997d02c91acfb919058dc605f4ffac84c30810047a68dc9fc2354662d960a80078ad67286da7891f7b141eb0eb93dfb8f26f8d1b9da53d95573626ff55b540b

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\wicplug.cab
                                                                                                                                                            Filesize

                                                                                                                                                            488KB

                                                                                                                                                            MD5

                                                                                                                                                            d154285db25d6f0aaf69f73c0b3e68a0

                                                                                                                                                            SHA1

                                                                                                                                                            064791f1aa6d2167b18d3c295f7857a5dc7bb0bc

                                                                                                                                                            SHA256

                                                                                                                                                            a21126d1ee724ab98de9adb36341a40b3d509c5e5261fe66c9a865686976c6e0

                                                                                                                                                            SHA512

                                                                                                                                                            421525e888db41c6879bace1fa6054c02efd2a88a2ca62f818850af26ace6a6d0b3e9d6a9faa2f09f17e8081002104700b96b6cd4773118e7cb4d03ee8d40e2a

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\wmfplug4.cab
                                                                                                                                                            Filesize

                                                                                                                                                            322KB

                                                                                                                                                            MD5

                                                                                                                                                            b5a8677ae7be53ec7afd0b21a5d5f668

                                                                                                                                                            SHA1

                                                                                                                                                            15f645cf23dff8bac8962f8ed9747c0d869c954e

                                                                                                                                                            SHA256

                                                                                                                                                            ed5f8329b3c079e0cd288e5f278f4d21a82850e1e49f24d8728c5dda67bd6fd4

                                                                                                                                                            SHA512

                                                                                                                                                            551e3a374517057609d5521aed2d19874ea20a100d6e6c990890f336cccb29997ed2bea37d92b4a71b9e8dad654c5ff9d2fb05423269d4df93223a06915b5a30

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\xpvinyl.cab
                                                                                                                                                            Filesize

                                                                                                                                                            1.1MB

                                                                                                                                                            MD5

                                                                                                                                                            143c0ad1f5d1f83ec19f66d4dfcaafbc

                                                                                                                                                            SHA1

                                                                                                                                                            46ce574dc94a82c7fe15dca9216615b7aa434db9

                                                                                                                                                            SHA256

                                                                                                                                                            b608e8b8bad4c31d63426b2432f1228637d602aa6549db41f028b59275b82587

                                                                                                                                                            SHA512

                                                                                                                                                            ad5d96d607b75be8fcaa304e08a0cf95cbd9c3798f0276beca45d455a3577a57abfe7772214b4f1dfe309cb35177e6c67fe29cbd3cb34ace3440d91b47074ebc

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Sony\msvcrt_redist_14022023-104545.log
                                                                                                                                                            Filesize

                                                                                                                                                            2B

                                                                                                                                                            MD5

                                                                                                                                                            f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                            SHA1

                                                                                                                                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                            SHA256

                                                                                                                                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                            SHA512

                                                                                                                                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Windows\Installer\MSI626.tmp
                                                                                                                                                            Filesize

                                                                                                                                                            1.7MB

                                                                                                                                                            MD5

                                                                                                                                                            aa6140d90ba59625eff857dc9bf64125

                                                                                                                                                            SHA1

                                                                                                                                                            1c29f7ab92a4d6175dad72667b6d89a212349e07

                                                                                                                                                            SHA256

                                                                                                                                                            494d77dadb86b7bc5ed7fa8b6a3cfc16211104cb7a460808dc616118ad693888

                                                                                                                                                            SHA512

                                                                                                                                                            0e61051634cd825195d1d52f240bfdaefe48a64f9f9403d6e932357ea6020aa70bb1e5344fb010b16cea325c5d3023244587b5e3ddcf155a1dcd6e11e1a9e9f5

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Windows\Installer\MSI626.tmp
                                                                                                                                                            Filesize

                                                                                                                                                            1.7MB

                                                                                                                                                            MD5

                                                                                                                                                            aa6140d90ba59625eff857dc9bf64125

                                                                                                                                                            SHA1

                                                                                                                                                            1c29f7ab92a4d6175dad72667b6d89a212349e07

                                                                                                                                                            SHA256

                                                                                                                                                            494d77dadb86b7bc5ed7fa8b6a3cfc16211104cb7a460808dc616118ad693888

                                                                                                                                                            SHA512

                                                                                                                                                            0e61051634cd825195d1d52f240bfdaefe48a64f9f9403d6e932357ea6020aa70bb1e5344fb010b16cea325c5d3023244587b5e3ddcf155a1dcd6e11e1a9e9f5

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Windows\Installer\MSIC42.tmp
                                                                                                                                                            Filesize

                                                                                                                                                            1.7MB

                                                                                                                                                            MD5

                                                                                                                                                            aa6140d90ba59625eff857dc9bf64125

                                                                                                                                                            SHA1

                                                                                                                                                            1c29f7ab92a4d6175dad72667b6d89a212349e07

                                                                                                                                                            SHA256

                                                                                                                                                            494d77dadb86b7bc5ed7fa8b6a3cfc16211104cb7a460808dc616118ad693888

                                                                                                                                                            SHA512

                                                                                                                                                            0e61051634cd825195d1d52f240bfdaefe48a64f9f9403d6e932357ea6020aa70bb1e5344fb010b16cea325c5d3023244587b5e3ddcf155a1dcd6e11e1a9e9f5

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Windows\Installer\MSIC42.tmp
                                                                                                                                                            Filesize

                                                                                                                                                            1.7MB

                                                                                                                                                            MD5

                                                                                                                                                            aa6140d90ba59625eff857dc9bf64125

                                                                                                                                                            SHA1

                                                                                                                                                            1c29f7ab92a4d6175dad72667b6d89a212349e07

                                                                                                                                                            SHA256

                                                                                                                                                            494d77dadb86b7bc5ed7fa8b6a3cfc16211104cb7a460808dc616118ad693888

                                                                                                                                                            SHA512

                                                                                                                                                            0e61051634cd825195d1d52f240bfdaefe48a64f9f9403d6e932357ea6020aa70bb1e5344fb010b16cea325c5d3023244587b5e3ddcf155a1dcd6e11e1a9e9f5

                                                                                                                                                            Download Submit

                                                                                                                                                          • memory/100-240-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/100-238-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/720-267-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/940-292-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/940-290-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1132-206-0x000002AE51D10000-0x000002AE51D26000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1260-218-0x000001E4318C0000-0x000001E4318D6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1276-302-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1276-259-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1276-256-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1276-300-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1304-255-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1304-253-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1420-216-0x0000020E0D200000-0x0000020E0D216000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1856-324-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2044-284-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2044-286-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2112-210-0x00000218593B0000-0x00000218593C6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2164-289-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2164-287-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2188-306-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2188-308-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2420-314-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2420-316-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2692-327-0x0000000007A90000-0x0000000007ADF000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            316KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2692-330-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2692-328-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2760-208-0x0000021A233C0000-0x0000021A233D6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2820-200-0x00000202E42C0000-0x00000202E42D6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3108-296-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3176-303-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3176-305-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3220-352-0x0000000004600000-0x000000000476B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3220-361-0x0000000004A20000-0x0000000004B48000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.2MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3492-204-0x0000028448AC0000-0x0000028448AD6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3588-275-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3588-322-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3588-277-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3588-336-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3644-214-0x000002C63FF10000-0x000002C63FF26000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3656-220-0x0000017882480000-0x0000017882496000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3680-310-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3704-202-0x0000023614B50000-0x0000023614B66000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3772-242-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3896-262-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3896-260-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3956-280-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3956-278-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4032-269-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4212-274-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4212-272-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4392-294-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4440-252-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4440-250-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4452-335-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4456-299-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4456-297-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4532-212-0x000001B66FC40000-0x000001B66FC56000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            88KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4544-227-0x00007FF7A18E0000-0x00007FF7A48AA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            47.8MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4628-338-0x00007FF7A18E0000-0x00007FF7A48AA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            47.8MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4628-337-0x00007FF7A18E0000-0x00007FF7A48AA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            47.8MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4640-318-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4664-283-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4664-281-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4704-237-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4704-234-0x0000000007D70000-0x0000000007DEA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            488KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4704-231-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4704-233-0x0000000007AD0000-0x0000000007B1F000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            316KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4756-265-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4756-263-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4764-271-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4784-326-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-357-0x0000000007750000-0x0000000007956000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            2.0MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-355-0x00000000074F0000-0x000000000774C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            2.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-363-0x00000000099A0000-0x0000000009A1C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            496KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-362-0x0000000008020000-0x0000000008070000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            320KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-349-0x0000000004000000-0x0000000004007000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            28KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-360-0x0000000008080000-0x0000000008243000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.8MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-348-0x00000000040C0000-0x0000000004132000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            456KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-358-0x0000000007A70000-0x0000000007C40000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.8MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-356-0x0000000007390000-0x0000000007409000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            484KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-347-0x00007FF757E70000-0x00007FF75AE3A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            47.8MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-354-0x0000000006ED0000-0x0000000007388000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-351-0x0000000006DE0000-0x0000000006EC2000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            904KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-350-0x0000000006A70000-0x0000000006DD5000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.4MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4936-359-0x0000000007960000-0x0000000007A62000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.0MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4968-249-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4984-257-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4984-247-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5000-333-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5000-334-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5000-331-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5016-313-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5016-311-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5068-320-0x00000000748E0000-0x0000000074E91000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.7MB

                                                                                                                                                            Download