hawkeye | ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08

Resubmissions

05-02-2024 19:28

240205-x6tp5agfhp 10

05-02-2024 16:28

240205-ty322scah7 10

04-02-2024 23:08

240204-24qb5sehfn 10

Analysis

max time kernel
269s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9066bf885cd72e46771654d0d8be15d3.exe
Size

201KB
MD5

9066bf885cd72e46771654d0d8be15d3
SHA1

13afce866b59c99fa0319b7f204e6b6828d4b22c
SHA256

ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08
SHA512

ed55f1e9567c5076172f9037a6487fe406b0a87ecb7f8cc892a2e2d1cd9a2d832f7286d286dc90b85de34ecc0216309e5fe658c9c14cbaf07d4e1a4df42861ec
SSDEEP

6144:Cz+glrx25snmJr/TqRd4y/Nns9ImK+BqIbsJHo57:Cz+glrxcsnor/mRGmsCt+BqFxod

Score

10^/10

hawkeye discovery evasion keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\windws.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exetv_enua.exeMSAGENT.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	MSAGENT.EXE

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9066bf885cd72e46771654d0d8be15d3.exeexplorer.exemvscavAP.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	9066bf885cd72e46771654d0d8be15d3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	mvscavAP.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

1428 explorer.exe

Executes dropped EXE 10 IoCs

Processes:

explorer.exeexplorer.exemvscavAP.exeSiaPort.exeSiaPort.exeMSAGENT.EXEtv_enua.exeAgentSvr.exeBonziBDY_4.EXEAgentSvr.exe

pid	process
1428	explorer.exe
1048	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1660	SiaPort.exe
5100	MSAGENT.EXE
5776	tv_enua.exe
1252	AgentSvr.exe
5688	BonziBDY_4.EXE
4828	AgentSvr.exe

Loads dropped DLL 36 IoCs

Processes:

BonziBuddy432.exetv_enua.exeregsvr32.exeregsvr32.exeMSAGENT.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeBonziBDY_4.EXEAgentSvr.exe

pid	process
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
4384	BonziBuddy432.exe
5776	tv_enua.exe
5748	regsvr32.exe
5748	regsvr32.exe
3084	regsvr32.exe
5100	MSAGENT.EXE
4332	regsvr32.exe
3116	regsvr32.exe
4876	regsvr32.exe
5220	regsvr32.exe
1144	regsvr32.exe
1628	regsvr32.exe
3096	regsvr32.exe
5688	BonziBDY_4.EXE
5688	BonziBDY_4.EXE
5688	BonziBDY_4.EXE
5688	BonziBDY_4.EXE
5688	BonziBDY_4.EXE
5688	BonziBDY_4.EXE
4828	AgentSvr.exe
4828	AgentSvr.exe
4828	AgentSvr.exe
4828	AgentSvr.exe
4828	AgentSvr.exe
5688	BonziBDY_4.EXE
5688	BonziBDY_4.EXE

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1048-22-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1048-25-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1048-26-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1048-27-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exemvscavAP.exetv_enua.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windws.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windws.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\mvscavAP.exe"	mvscavAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

Processes:

tv_enua.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\SET48F6.tmp	tv_enua.exe
File created	C:\Windows\SysWOW64\SET48F6.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	tv_enua.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

explorer.exeSiaPort.exe

description	pid	process	target process
PID 1428 set thread context of 1048	1428	explorer.exe	explorer.exe
PID 5228 set thread context of 1660	5228	SiaPort.exe	SiaPort.exe

Drops file in Program Files directory 64 IoCs

Processes:

BonziBuddy432.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\BonziBuddy.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb001.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page0.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page9.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Uninstall.exe	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\AUTPRX32.DLL	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\emsmtp.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page4.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp003.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page13.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page16.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\Thumbs.db	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page5.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page7.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziCTB.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\msvbvm60.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\AutoDirPatcher.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb007.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb015.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page15.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page14.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page16.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page20.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Apps.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\book	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page6.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\RACREG32.DLL	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Runtimes\spchcpl.exe	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\t2.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page4.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb004.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page2.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page8.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY.vbw	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\empop3.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\speedup.ico	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\t001.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page7.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page8.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page16.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Bonzi's Solitaire.exe	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Intro2.wav	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page6.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page10.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page9.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page8.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp001.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp005.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page13.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\chose.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page9.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page15.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page4.jpg	BonziBuddy432.exe

Drops file in Windows directory 56 IoCs

Processes:

MSAGENT.EXEBonziBuddy432.exetv_enua.exe

description	ioc	process
File opened for modification	C:\Windows\msagent\intl\Agt0409.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\chars\Bonzi.acs	BonziBuddy432.exe
File created	C:\Windows\INF\SET48F5.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File opened for modification	C:\Windows\msagent\SET4E0B.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET4DE4.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET4DE4.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentDp2.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentCtl.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentPsh.dll	MSAGENT.EXE
File created	C:\Windows\help\SET4E0C.tmp	MSAGENT.EXE
File created	C:\Windows\INF\SET4E0A.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\agtinst.inf	MSAGENT.EXE
File created	C:\Windows\msagent\SET4E0B.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\SET4E1D.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgtCtl15.tlb	MSAGENT.EXE
File created	C:\Windows\lhsp\tv\SET48E1.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\tv\tvenuax.dll	tv_enua.exe
File created	C:\Windows\msagent\SET4DE6.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET4DF8.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET4DF8.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\SET4E0C.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\SET4E0A.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET4DD3.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET4DE5.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET4E09.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\Agt0409.hlp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SET48E2.tmp	tv_enua.exe
File created	C:\Windows\lhsp\tv\SET48E2.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\SET4DF6.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\chars\Peedy.acs	BonziBuddy432.exe
File opened for modification	C:\Windows\fonts\SET48E4.tmp	tv_enua.exe
File opened for modification	C:\Windows\fonts\andmoipa.ttf	tv_enua.exe
File created	C:\Windows\msagent\SET4DE5.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET4DE6.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentMPx.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\mslwvtts.dll	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	tv_enua.exe
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	tv_enua.exe
File created	C:\Windows\fonts\SET48E4.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\SET4E1E.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET4E09.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SET48E1.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\help\SET48E3.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentSR.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET4DD3.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET4DF6.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentDPv.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET4DF7.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET4E1E.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\help\SET48E3.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\SET48F5.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentSvr.exe	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET4DF7.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentAnm.dll	MSAGENT.EXE
File created	C:\Windows\msagent\intl\SET4E1D.tmp	MSAGENT.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

Processes:

BonziBuddy432.exeregsvr32.exeAgentSvr.exeBonziBDY_4.EXEregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSFrame	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FE7-1BF9-11D2-BAE8-00104B9E0792}\ProxyStubClsid32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DAB85C3-803A-11D0-AC63-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1533A365-F76F-4518-8A56-4CD34547F8AB}\Implemented Categories	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B976285-3692-11D0-9B8A-0000C0F04C96}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FD4-1BF9-11D2-BAE8-00104B9E0792}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}\2.0\HELPDIR\ = "C:\\Windows\\msagent\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BA90C00-3910-11D1-ACB3-00C04FD97575}	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCE47F78-8A6C-4C6D-A6F7-8BE4427127C4}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip\CurVer	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FDC-1BF9-11D2-BAE8-00104B9E0792}\Printable	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14E27A73-69F0-11CE-9425-0000C0C14E92}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.ComMoveSize\CLSID	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B1BE80A-567F-11D1-B652-0060976C699F}\1.1\0\win32	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\Programmable	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FEA-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\Version = "3.0"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98BBE491-2EED-11D1-ACAC-00C04FD97575}\TypeLib	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DACB7A39-CC0D-4B85-908B-10D2451761A5}\ProxyStubClsid32	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinForm.1\CLSID	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7AE601-0142-11D3-9DCF-89BE4EFB591E}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{322982E0-0855-11D3-9DCF-DDFB3AB09E18}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B1BE807-567F-11D1-B652-0060976C699F}\ = "RegiCon"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSCommand.3\ = "SSCommand Control 3.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07D0E280-EF44-11CD-836C-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24830770-5D94-11CE-9412-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C87-7B81-11D0-AC5F-00C04FD97575}	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{972DE6C2-8B09-11D2-B652-A1FD6CC34260}\InprocServer32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlCharacters"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FDC-1BF9-11D2-BAE8-00104B9E0792}\MiscStatus\1\ = "237969"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D41-2CDD-11D3-9DD0-D3CD4078982A}\Insertable	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1533A365-F76F-4518-8A56-4CD34547F8AB}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\MiscStatus\1	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E91E27A3-C5AE-11D2-8D1B-00104B9E072A}\MiscStatus\1\ = "205201"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{822DB1C0-8879-11D1-9EC6-00C04FD7081F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FDB-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FDD-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FE8-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{643F1352-1D07-11CE-9E52-0000C0554C0A}\ = "_DDayviewEvents"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA141FD0-AC7F-11d1-97A3-0060082730FF}\InprocServer32\ = "C:\\Windows\\lhsp\\tv\\tv_enua.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0913410-3B44-11D1-ACBA-00C04FD97575}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D4C-2CDD-11D3-9DD0-D3CD4078982A}\ = "ISkinScrollBar"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E91E27A3-C5AE-11D2-8D1B-00104B9E072A}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28E4193C-F276-4568-BCDC-DD15D88FADCC}	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4E0988E-24BE-4570-B4D8-982F1386E0C6}	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D4D-2CDD-11D3-9DD0-D3CD4078982A}\InprocServer32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}\2.0\ = "Microsoft Agent Control 2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4043742-AC8D-4F86-88E9-F3FD3369DD8C}\TypeLib	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D4D-2CDD-11D3-9DD0-D3CD4078982A}\MiscStatus\1	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC1-E669-11CD-836C-0000C0C14E92}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDA1CA00-8B5D-11D0-9BC0-0000C0F04C96}\ = "ISSReturnLong"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA141FD0-AC7F-11d1-97A3-0060082730FF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0913412-3B44-11D1-ACBA-00C04FD97575}\TypeLib	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinItem\CurVer	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C01387A-6AC2-4EF1-BDA2-EC5D26E3B065}\ = "IComTransitions"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Control	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\MiscStatus\ = "0"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FE1-1BF9-11D2-BAE8-00104B9E0792}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FE5-1BF9-11D2-BAE8-00104B9E0792}\TypeLib	BonziBuddy432.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

5956 reg.exe
5292 reg.exe
5124 reg.exe
5812 reg.exe

pid	process
5956	reg.exe
5292	reg.exe
5124	reg.exe
5812	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exemvscavAP.exeSiaPort.exe

pid	process
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe
208	mvscavAP.exe
5228	SiaPort.exe
1428	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

Processes:

msedge.exe

pid	process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

9066bf885cd72e46771654d0d8be15d3.exeexplorer.exeexplorer.exemvscavAP.exeSiaPort.exeAgentSvr.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	6096	9066bf885cd72e46771654d0d8be15d3.exe
Token: SeDebugPrivilege	1428	explorer.exe
Token: 1	1048	explorer.exe
Token: SeCreateTokenPrivilege	1048	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	1048	explorer.exe
Token: SeLockMemoryPrivilege	1048	explorer.exe
Token: SeIncreaseQuotaPrivilege	1048	explorer.exe
Token: SeMachineAccountPrivilege	1048	explorer.exe
Token: SeTcbPrivilege	1048	explorer.exe
Token: SeSecurityPrivilege	1048	explorer.exe
Token: SeTakeOwnershipPrivilege	1048	explorer.exe
Token: SeLoadDriverPrivilege	1048	explorer.exe
Token: SeSystemProfilePrivilege	1048	explorer.exe
Token: SeSystemtimePrivilege	1048	explorer.exe
Token: SeProfSingleProcessPrivilege	1048	explorer.exe
Token: SeIncBasePriorityPrivilege	1048	explorer.exe
Token: SeCreatePagefilePrivilege	1048	explorer.exe
Token: SeCreatePermanentPrivilege	1048	explorer.exe
Token: SeBackupPrivilege	1048	explorer.exe
Token: SeRestorePrivilege	1048	explorer.exe
Token: SeShutdownPrivilege	1048	explorer.exe
Token: SeDebugPrivilege	1048	explorer.exe
Token: SeAuditPrivilege	1048	explorer.exe
Token: SeSystemEnvironmentPrivilege	1048	explorer.exe
Token: SeChangeNotifyPrivilege	1048	explorer.exe
Token: SeRemoteShutdownPrivilege	1048	explorer.exe
Token: SeUndockPrivilege	1048	explorer.exe
Token: SeSyncAgentPrivilege	1048	explorer.exe
Token: SeEnableDelegationPrivilege	1048	explorer.exe
Token: SeManageVolumePrivilege	1048	explorer.exe
Token: SeImpersonatePrivilege	1048	explorer.exe
Token: SeCreateGlobalPrivilege	1048	explorer.exe
Token: 31	1048	explorer.exe
Token: 32	1048	explorer.exe
Token: 33	1048	explorer.exe
Token: 34	1048	explorer.exe
Token: 35	1048	explorer.exe
Token: SeDebugPrivilege	208	mvscavAP.exe
Token: SeDebugPrivilege	5228	SiaPort.exe
Token: 33	4828	AgentSvr.exe
Token: SeIncBasePriorityPrivilege	4828	AgentSvr.exe
Token: 33	4340	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4340	AUDIODG.EXE
Token: 33	4828	AgentSvr.exe
Token: SeIncBasePriorityPrivilege	4828	AgentSvr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exeAgentSvr.exe

pid	process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
4828	AgentSvr.exe
4828	AgentSvr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

explorer.exeSiaPort.exeBonziBuddy432.exetv_enua.exeMSAGENT.EXEAgentSvr.exeBonziBDY_4.EXE

pid	process
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1660	SiaPort.exe
1660	SiaPort.exe
4384	BonziBuddy432.exe
5776	tv_enua.exe
5100	MSAGENT.EXE
1252	AgentSvr.exe
5688	BonziBDY_4.EXE
5688	BonziBDY_4.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9066bf885cd72e46771654d0d8be15d3.exeexplorer.exeexplorer.execmd.execmd.execmd.execmd.exemvscavAP.exeSiaPort.exemsedge.exe

description	pid	process	target process
PID 6096 wrote to memory of 1428	6096	9066bf885cd72e46771654d0d8be15d3.exe	explorer.exe
PID 6096 wrote to memory of 1428	6096	9066bf885cd72e46771654d0d8be15d3.exe	explorer.exe
PID 6096 wrote to memory of 1428	6096	9066bf885cd72e46771654d0d8be15d3.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1428 wrote to memory of 1048	1428	explorer.exe	explorer.exe
PID 1048 wrote to memory of 5248	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 5248	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 5248	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 2044	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 2044	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 2044	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 3212	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 3212	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 3212	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 3596	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 3596	1048	explorer.exe	cmd.exe
PID 1048 wrote to memory of 3596	1048	explorer.exe	cmd.exe
PID 1428 wrote to memory of 208	1428	explorer.exe	mvscavAP.exe
PID 1428 wrote to memory of 208	1428	explorer.exe	mvscavAP.exe
PID 1428 wrote to memory of 208	1428	explorer.exe	mvscavAP.exe
PID 3212 wrote to memory of 5956	3212	cmd.exe	reg.exe
PID 3212 wrote to memory of 5956	3212	cmd.exe	reg.exe
PID 3212 wrote to memory of 5956	3212	cmd.exe	reg.exe
PID 3596 wrote to memory of 5812	3596	cmd.exe	reg.exe
PID 3596 wrote to memory of 5812	3596	cmd.exe	reg.exe
PID 3596 wrote to memory of 5812	3596	cmd.exe	reg.exe
PID 5248 wrote to memory of 5124	5248	cmd.exe	reg.exe
PID 5248 wrote to memory of 5124	5248	cmd.exe	reg.exe
PID 5248 wrote to memory of 5124	5248	cmd.exe	reg.exe
PID 2044 wrote to memory of 5292	2044	cmd.exe	reg.exe
PID 2044 wrote to memory of 5292	2044	cmd.exe	reg.exe
PID 2044 wrote to memory of 5292	2044	cmd.exe	reg.exe
PID 208 wrote to memory of 5228	208	mvscavAP.exe	SiaPort.exe
PID 208 wrote to memory of 5228	208	mvscavAP.exe	SiaPort.exe
PID 208 wrote to memory of 5228	208	mvscavAP.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 5228 wrote to memory of 1660	5228	SiaPort.exe	SiaPort.exe
PID 2488 wrote to memory of 5996	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 5996	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe
PID 2488 wrote to memory of 3040	2488	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\9066bf885cd72e46771654d0d8be15d3.exe
"C:\Users\Admin\AppData\Local\Temp\9066bf885cd72e46771654d0d8be15d3.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3596
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3212
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe
    "C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
      "C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
        
        C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
1⤵
- Modifies firewall policy service
- Modifies registry key
PID:5956

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe:*:Enabled:Windows Messanger" /f
1⤵
- Modifies firewall policy service
- Modifies registry key
PID:5292

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
1⤵
- Modifies firewall policy service
- Modifies registry key
PID:5124

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe:*:Enabled:Windows Messanger" /f
1⤵
- Modifies firewall policy service
- Modifies registry key
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa0f1746f8,0x7ffa0f174708,0x7ffa0f174718
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1168 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3929277629048850355,13835016973993416536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "
  2⤵
  PID:1380
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe
    tv_enua.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:5776
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:5748
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      Loads dropped DLL
      PID:3084
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:5212
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE
    MSAGENT.EXE
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:5100
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4332
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
      4⤵
      Loads dropped DLL
      PID:4876
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
      4⤵
      Loads dropped DLL
      PID:5220
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
      4⤵
      Loads dropped DLL
      PID:1628
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
      4⤵
      Loads dropped DLL
      PID:3096
  - - C:\Windows\msagent\AgentSvr.exe
      "C:\Windows\msagent\AgentSvr.exe" /regserver
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:1252
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:5612
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
      4⤵
      Loads dropped DLL
      PID:1144
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
      4⤵
      Loads dropped DLL
      PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzibuddy.tk/
  2⤵
  PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa0f1746f8,0x7ffa0f174708,0x7ffa0f174718
1⤵
PID:3652

C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5688

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx

Filesize
265KB

MD5
f5dc9a3adaf9eab39b80aa7ad40f05df

SHA1
1ddedf57445f16fc69ca4d319f3e48626b518a72

SHA256
65ff19b444a95e138ea1d69d82e50284e58706ea481a44c4ff4d90f1ff30f33e

SHA512
38d1f25cc5a83895c04673468effcaba626959161c06fefebf165efbcd6d8a2558a7039dce7f60fe9f903d338461b8949e40a7c4334d2c8a13963bf0bec4d761

Download Submit
C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx

Filesize
136KB

MD5
ab548850f62a005ee615f6f89f122ca7

SHA1
2dfd679a9ec04be93ab1ae1eec2f635b1d4bf7a5

SHA256
302654363f36a381a0c5abb612d56869e7e3be391a4a4539af85ef43b03880f6

SHA512
f018cbf5c155c2311679bda674e5c1b8fdd7b7077c7eac24b219acfd4e5c1dd6b95fdc08037d0cf6e7b02c3cfdf44d460672a0e202c6b5bcdc422bb5bfdcfc2a

Download Submit
C:\Program Files (x86)\BonziBuddy432\Bonzi's Beach Checkers.exe

Filesize
302KB

MD5
895a705281eaf61c2d0c38bd688707e8

SHA1
1132b0a041819c3446dadb425aa37cc9a277d80c

SHA256
bd77a118bbede319135ce43492b56758059b5955539a848ff22862ca929de83f

SHA512
864ccdad24ea2214cc17ba548220f0aa1444e0ce552720796b16778105217c0573a3ec7d85e4571c63bff0a3075e81c1081a5b6b43ed020f92885245d36b31a0

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE

Filesize
299KB

MD5
45995c54636c98572af53010d5d2d6f2

SHA1
eebaef8b2ac49ed77377107a8e9b236cd9b308d5

SHA256
41982be9847cc6eb28560409f00b4d42b9561d12de9e4a694be8e7e5fdc9c855

SHA512
224ee5acc8b0d34092087b4b47a5e4f9bdb2a21b85add783537d240b2a2466d0ddfb635db1f897dc18cde3caf4489a6a5c7a85e6eb6dbed959eddb9e9b721e1f

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE

Filesize
204KB

MD5
372c4529511550974a3fa23bca069ca9

SHA1
94f32ef29f8aeaf2995dfff791653c9d1fe612d3

SHA256
dcde53420e22a0acea0ebe08a62d1438127b7ad6cdfda0db8b307750f382fa23

SHA512
c11a1e4886110c0b604446a8d708f5a16b6245e68dd66f6cf8ece58ff8c9b0c51c5340a113e9026915f91c931d4e0cf5447352567a9696144f35d40b23601d4a

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE

Filesize
340KB

MD5
343a33d2b24e8d4281316a4d72b113ae

SHA1
668bdd80a9d4250af3bf07439fe6dc210f3334f4

SHA256
f59fccd390ba5129e9d4ac09013914b1a85ab51ad0b07b8a23399209d3be97ca

SHA512
1bd109561de1b64c4836f671e74cb2b4b828edb36c83cb61ceab0cd5e1cbe54d280e56ca4129bdf539c9695f6ae0c18bac1aabe46e00c639c700b01a13867788

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocx

Filesize
143KB

MD5
2018ccc8a049f19a064228b76c7d63ea

SHA1
3793d26512ee5f53b97f0f2d648eeac318d51b2a

SHA256
ea278a54f7bbbb1fc7b6e3b8916a1c837198e70eee5a47dcdfe0b3d1bcd6fdc8

SHA512
c87233b47d77390445dc57e518da2842cd07bbe6fb6c616aec39dc750062ccd683884a5ff17a4981588c7a9c30a2c0a3ca02987d11954ff35e98a8c904659be1

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocx

Filesize
152KB

MD5
66551c972574f86087032467aa6febb4

SHA1
5ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9

SHA256
9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b

SHA512
35c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089

Download Submit
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg

Filesize
50KB

MD5
e8f52918072e96bb5f4c573dbb76d74f

SHA1
ba0a89ed469de5e36bd4576591ee94db2c7f8909

SHA256
473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82

SHA512
d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f

Download Submit
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg

Filesize
45KB

MD5
108fd5475c19f16c28068f67fc80f305

SHA1
4e1980ba338133a6fadd5fda4ffe6d4e8a039033

SHA256
03f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b

SHA512
98c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a

Download Submit
C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCX

Filesize
181KB

MD5
cc33a134c3b92d8b0df6c27c215a08a1

SHA1
c55703cb55afa6863e0f87c34bc8018098bf2c80

SHA256
9d829dc2547927826072b927a40a8372c34a4aa22cdd26e3be18d2bd98010d92

SHA512
e1d562deb01286287b9559a9dc56b3777dc12fac80c289cbfbc2e035add09fa1a26a6b6f47b29b6e4bd866f7e3750d39023980f1e44d214324d69c3928c92642

Download Submit
C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCX

Filesize
274KB

MD5
d4fa1811448f4776ff2c33bfd8a07caf

SHA1
4d386de243ecc451dfb27c9395b6e1e71d219c4c

SHA256
e8e7bf7def1e7d37f38252bcf971aa77c97323ec58000af90c0a869ab172b9f7

SHA512
6ef3a6b1bea8bd7a07437cad2b664d0dc3e8b766ebff3dc27631eb83227da80e6caa2f54dd6c55b5de5c695440af3a3c350438f096669f98270d8fc3ba2c499b

Download Submit
C:\Program Files (x86)\BonziBuddy432\MSINET.OCX

Filesize
112KB

MD5
7bec181a21753498b6bd001c42a42722

SHA1
3249f233657dc66632c0539c47895bfcee5770cc

SHA256
73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31

SHA512
d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc

Download Submit
C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
C:\Program Files (x86)\BonziBuddy432\Reg.nbd

Filesize
140B

MD5
a8ed45f8bfdc5303b7b52ae2cce03a14

SHA1
fb9bee69ef99797ac15ba4d8a57988754f2c0c6b

SHA256
375ecd89ee18d7f318cf73b34a4e15b9eb16bc9d825c165e103db392f4b2a68b

SHA512
37917594f22d2a27b3541a666933c115813e9b34088eaeb3d74f77da79864f7d140094dfac5863778acf12f87ccda7f7255b7975066230911966b52986da2d5c

Download Submit
C:\Program Files (x86)\BonziBuddy432\Regicon.ocx

Filesize
76KB

MD5
32ff40a65ab92beb59102b5eaa083907

SHA1
af2824feb55fb10ec14ebd604809a0d424d49442

SHA256
07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42

SHA512
2cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43

Download Submit
C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat

Filesize
279B

MD5
4877f2ce2833f1356ae3b534fce1b5e3

SHA1
7365c9ef5997324b73b1ff0ea67375a328a9646a

SHA256
8ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff

SHA512
dd43ede5c3f95543bcc8086ec8209a27aadf1b61543c8ee1bb3eab9bc35b92c464e4132b228b12b244fb9625a45f5d4689a45761c4c5263aa919564664860c5e

Download Submit
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE

Filesize
71KB

MD5
8a9355f96063900cf05c7d241e487383

SHA1
0d48c881baf015ae531094964f29dffabd4e5365

SHA256
2db3157a5b54643c3291c9bbfe21c87655c64eb8376f5843d25c91df0bbc891c

SHA512
9e93275d2fdc616962d3f271714afcea3e1fd10e42a81d11b9f840b038a160a4b1f652cd14b21ab0ffc092871967ec999b938d8b2adfce417413130417ab5dc9

Download Submit
C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE

Filesize
142KB

MD5
cc8bcf048f95e014279e559a412cc544

SHA1
48ab5b92105d22186e6224374b9b15070c81ea52

SHA256
9b2eb3125370d53b0459ced1c2b29ab7ae36e890f8c67e154d843f084de8c3d9

SHA512
e2802b928f673a949541f42d7f5844c6af2ac6f81d30058eedf3294796396e48de3c565c73db9a3e3e518051a95e3c979042d28132772ae4fce83655acb1adf5

Download Submit
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe

Filesize
136KB

MD5
41f864e1b633319faf075d97a873564e

SHA1
e54cf739f93ce3c91ff573bdd52c5912a06825aa

SHA256
63d0e5535d28b096f11ea6fe19d3504b813dd33772f1eafb6a8cd7e483d97d6a

SHA512
f8b1e21467ef981c103e3e746528c35afbf464236efa637381a399f76f244eeae2d8cfa91b9abb600d266a0cbcae40fb1391b36a8e53656b76586ad21d4432d6

Download Submit
C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe

Filesize
164KB

MD5
c194f799cac14dde647ab6f978868758

SHA1
bfbdba08b2a8cd91b9c915349ac8b3545a650e11

SHA256
27408a33b2cbcb66480ddfa7a999e12ad4b201438a12d71e48d3904618a75df4

SHA512
c26795d743c088021eeeb14828236709b2a5dd14ad29ac6b0f73192f5933beab12dcde9fa70a566cafb90e1fefdfc45e69b0a89460f5a1a8e25493eefe5c98fc

Download Submit
C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX

Filesize
122KB

MD5
0c2c398ec649f1c77cd381dae9c4d06a

SHA1
5745c736d42d6f28fbad8e991da94e70da43da3f

SHA256
dbcf1c25d52d6b83d47463e886b233451792762dfcda631fe0dd150819b7910f

SHA512
53dbabdef438c62f3f311070c1f34fbd965438992faa987e83a12bdc80b60a156ffa929597668176a2b0ea55614472c606ff8ce84d05f043f0477510962f7c16

Download Submit
C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX

Filesize
103KB

MD5
f7cc2b93ed23ae3f4586b756e5d78b50

SHA1
073a5181beb0fbd5f4cfd2e875e156b4f5497a43

SHA256
186ee4404469775ceca128c101d0a437d6d572f771380e36090699f7886db0d6

SHA512
fd01d06696a7973f742577064489c78a157afd05a9d3c68b0363e7d0f7cdadd28620e78b68b7e46912b2cc076a7a2bb595b6fb0b91a389f6a60e18e09ff7dd59

Download Submit
C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX

Filesize
194KB

MD5
3282a52c7ad761992fdaa293b7e2f763

SHA1
25e2f0326f5147a88ddd4ae169ee1344f60984ac

SHA256
5106d3311b32379de7ecbd417e432727bf7675b0a354ba25e29e8931d4f67859

SHA512
ed5feba07ce5fa4c3ffa4e632bff15bef9313bc87faa62df9d9dde09f986217b8871c206fe35fa57dd7bdc126fd36b1e9700b1192e9bfb4badf30c51cc2baa3c

Download Submit
C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX

Filesize
122KB

MD5
71fd2556fac9b1dabed85a510359fab3

SHA1
d5233e93a17b86d617c052f8a74aa17b3942f88f

SHA256
0de18dcd34e0f14902b5ceab2d41923e7c5490d57159ec16bf1cd2190953d7e1

SHA512
a334286f4dc94341712d008c6306b62bc02c8682ab75dd41fff28a49c4191bf4d69a781ceb56d6590e1c45551a19405f3fdd7a1f54b61ed5250075132e2c5f60

Download Submit
C:\Program Files (x86)\BonziBuddy432\Uninstall.exe

Filesize
65KB

MD5
068ace391e3c5399b26cb9edfa9af12f

SHA1
568482d214acf16e2f5522662b7b813679dcd4c7

SHA256
2288f4f42373affffbaa63ce2fda9bb071fd7f14dbcd04f52d3af3a219b03485

SHA512
0ba89fcdbb418ea6742eeb698f655206ed3b84c41ca53d49c06d30baed13ac4dfdb4662b53c05a28db0a2335aa4bc588635b3b205cfc36d8a55edfc720ac4b03

Download Submit
C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx

Filesize
184KB

MD5
0edd1fdec3f76a44f02cf1fb4107dfe9

SHA1
1d4d7cce31a389bf731ce1e70be2463159872cbb

SHA256
edbba92c0a440a0823c1ec09415e5390a7700ce7e0311350383850201c178d73

SHA512
359b6b1cfc386755e228b5f5062ed05f3e9575aa46eb7ba1cc3897e32857904e8d53c340cace2f54c836ea01adee9e16bc51a78a4c03c28fc5376957aeedacff

Download Submit
C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx

Filesize
122KB

MD5
0bdb4d8ca4336a887e8136a2b4d152dc

SHA1
1bc7fee7c9066d735b1bb3c1430db9226f9c27a0

SHA256
76c943727f4333320917ff95c4486a60b2b42426f7e70aeb4f7cd8f12cc5a1d0

SHA512
e760eebb6c068694d3a87bca41241d03c663087c6fafceaed83cf204cd797f665777334102ce8457a294c2f109d0333bf79a8a7f068622a9f42b78a0376655f8

Download Submit
C:\Program Files (x86)\BonziBuddy432\sstabs2.ocx

Filesize
47KB

MD5
c80fdba2a7bbc99ea50c7c3c6b9906df

SHA1
5946343ffaad05dcc81f2e7d3d38c30c265b4035

SHA256
b6939ee70f326c38af82306f56556a7a0a718c18a0bf0f7eab4b0ff67c962a43

SHA512
946e2ebb9939f170c11def3a94cf7c082df9e50d1f0728d4e232241da01b5cff7d06a77bc919e46449b706dc7f8fad0e1ac19f4b11db06443b8c55d41f6804b0

Download Submit
C:\Program Files (x86)\BonziBuddy432\sstabs2.ocx

Filesize
227KB

MD5
10bf15d104be1d58ed725f1cdfcc7e6a

SHA1
271e4f5e4bc2eaa0dd8b03e11b9d3e8d228d4195

SHA256
74c7d86cd6ae1c44a5d94e8ccaed93c6e5a6d7a31556aacf4d8b1f12d4bd2260

SHA512
dbfe4e20eec99a7dce07e346ca39cb060ec8112b5d05e85c2272bf9fbcf43494727035abc500bcb9c58e734c03584524da3efee4fd56963ea847500072e234ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
27KB

MD5
1d6d6c0e200e333c0a31f707e2f5cce9

SHA1
8918ad33f1d058efc61c21cc2e15956eb25f9407

SHA256
8126b462db0c212303afb2e26e7460f9d74579e7172efe04728fdc283ee0f49d

SHA512
0cd699e9be787b2bccb25cf34c5c0b5c30aff15eb62030eed5ac8bfa1efaaa9abc5c0763f7ece364774823d8ec511cecb02970552b1a0ef09130e08fe672411d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
c10533650ab2ce04634865c72de4c069

SHA1
36a8d127fb45ffe2707d97806d4e75b491aad8e6

SHA256
12c27ab7264cb8fe40062da6606b6b572d787e7282239d948e01e813439bb69a

SHA512
9fe25a1f0228bd5c1b8ad365e221edef202fbc8ba11dc008d40198a2b8223caf211e74d16bc4fc293a088dc6af6f9080f9f45f5d6696d42232d800390807a7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
2b958d56f7a80c1b9248f655218239ce

SHA1
d35476305c3adca0aedc7cb2daf32cf0ca368ead

SHA256
64fa33524bd120d33a17d1b95b1d38ce0a6efe0ae50665a9a46728703511707c

SHA512
1f192a96f49c2fb165638cbc3f09d6bf69c792bd3daa8511aaa4e57f6975cd5e480f346567b8410018a49f951d154a9e92afd9193712aafb424bc8e35fe14e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3211a033c2de79578bfbf4721c0a4011

SHA1
0ec79df2cd6d03843bfbf0395d5012240e19a50e

SHA256
e7f877ba21ef55b194cbdddbecd8ed82deb069d3432f8c5d36eee3b2d921f18e

SHA512
cd66c0207568dfbc0483ff2d08b64ca89bb2f5025a62663f9baa459d324ad2e8544e5a9d5387f5b517eacabef4fe1f67459965886d47bf597a338e62d78aa6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
695B

MD5
17a873120ac5ad3869ce729b6eaaf30a

SHA1
7a29f6ded9ce10bffb351a3a3a96c2092a6d003c

SHA256
0452d16e48cb037dac9f72b3400acff86559937c1dea0a30f8550c4684307637

SHA512
14a987c43bf7a000cb9220ce2df2382b430227508fa0bb2c9356111c72f056fe2782dbc6785d40d1f105d584c6989f78e8a424765b81332071e795b729fabd32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ad27976a38dc218c77ad24f9806c0e7e

SHA1
2f4ad964c8d0bba9c5c23b58e50a74d0ae77ace3

SHA256
8eb8a2ed9427241d828d136efc285dd1c0c7d5debe331f55793dafc48ac94008

SHA512
54ea0359116aecbe075a85c10152494f2f0e3ca966dda445365a9b5e84d1c941168ed8cb01abbbded480b576f1b6bcb135c7e406e8e89c42edab2acac7b1168e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45d334ba4c9310eb710688017dbf8912

SHA1
195d4a21c20c895c117268b2778f74e3019fb0f0

SHA256
121849436455b0822fae73e80943f495edeb50fcf8ad3a819413cc639abe282b

SHA512
188f9ab01153499386e14cd0d564fd73607acb9d3126231775c71fddb664ed515f3b8e7630199a5b474ef30fd5164bfdbcbb7d3721d63b43efefb0410c08350b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
57879eeaafc260353c516d18126b0906

SHA1
1afc601ad0123e57c9008e5f5538546e445d98f5

SHA256
68e27cb85f82e2c7370b3bd211e3b9dd550962696fad609a9b18c3d8559d0f25

SHA512
25a9cb2831ca929112055e1ba788835233c7351d99072463643c72d0e1d0cb85eefd89ad93affbcaaa1584a9db985c82c20bf3f2b0766895504da2ae8f5401b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
28d1b40bef52362128a04ed4cca3f5f9

SHA1
53880cb3fb7a9ec7b65de39a7e1a80ac5665d18b

SHA256
43d70028d2076087f1fba9113a8e2fb2546fc149f724b87ef75c57226799a800

SHA512
960a8fb85628b488477259735218e7499641b9baa79d7629423650fec8ce2ab778618bbceac97e14b33b31a75585a28d97fac49724f937dff075798337838a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c81bc3905809b5712929ea6cc6202acf

SHA1
7c9859d7e63940d43e8a5b2842c565fc247eaf35

SHA256
1b820b463741f9b4a4db41f53f697e79485d81c0779a89ec4916628a5b0bd2e0

SHA512
e42d96db32463f12a8f876c03ba00dbbb48ab1abd81903628413bb03cf677355114668c31c83d92df9dc5998962d1f7425ddfdb1c94f3a64c7c002249976a88c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f7cf3dd239b66a5248210271f4b2e28

SHA1
d00db4ea1cd370dbd71ced4c19b009ea0e672e27

SHA256
2c0d936243f0e62fec308d4455d2017619103d319d6970586ce311307a186ed2

SHA512
cbe92bf0e3baf55b385f785400ba5fc76c3e9bb1172942b5fd98c16ac8ea482f2fbd5152c7fb65d8991d201b39c551b5d7de3c74bb71e656311ea020f730ec5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c61f3bf0978d9db0455deeef20a4835d

SHA1
2a7057defbecad8087508a8922b1f2111c3f7788

SHA256
291e1b505d71b5d034ebbfbc928ba2fa41a0849be3fa21c6b106c0d8028fb076

SHA512
ea4268937e530c507541f82df0a6603eabd314f211924a7590bcc40b4b02d5553a151317041e3902c4d8c6c4450bf171e4846cc30032419976c59cb619a04e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
edb8804a81df0556612c86ea414015aa

SHA1
63fb013e2795745a2b0cbe9bd608f0f4f816e9cc

SHA256
6e9d46e9f952261f265ca4da1bd7f3d95a725ed33f7e2fe51e4990355feeb178

SHA512
3bc4d04728f40331fb764236991a1697a1b501c0c2c0621f58204532285933516d9c4ebf047809210eb7f345abc0a457b050154241b9176286160a4b41984e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
19089fbc4599a2b8ffecb23d17e307b3

SHA1
aa948dca3acbbb559026c27eba62f7e65af3cde2

SHA256
ff4499d69f69c2d0ad5de2b74bd2f33c9ebdeed629d85cf66b5c8b3c8b075957

SHA512
8455c25afac3c04874176cb0296054098f9c5287a13f5bc8024e0b151f234c5fd7bd1b9a4fcfdea27f11ef4bdbbccce8e8d7432767a1f85c5c72080e8f52a9a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58aa74.TMP

Filesize
538B

MD5
4046a6b2cc96dd227e3cbb3ed58df6fd

SHA1
628d6bbab343616498e057b13a73e45acc513dce

SHA256
8edbf07aef01214cef482e7eab98ba33099880280e194aaad5f4bd876ba7b76e

SHA512
00af1345c15f6ada6dd25677a972b2fb3f719c23f21921b4da329b37a96b3c21e9218d20f1abac59c72ecc98e3d53426c796ba924cdfdcf563a14a94f766dda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d2f4b04af391e1a957b268fe799d1299

SHA1
398379e887947c366a5be057e9e9dcc913c68535

SHA256
049b32f05ed7202d483187a7fd58bfde900db25197714b75026ccd9514c05d09

SHA512
132ddeb346b5021702a521dfcc0981f0de84cf3125ff720372304e2f35af3db2b8e0df6fb1e5ffbe3a4bdb76fe1f7fe604b0c4f2e830bb037752a5957a3d86ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d5b5351d3a9563ac10cf53deb359eda6

SHA1
1bd1d17e4ad399b6d6b2616c62db9073f1569569

SHA256
8d97c4234e3666a4ecfe75e5b671e700f6b99c7f521fb9a8047a5bd8c4134dbf

SHA512
9f90aebbbf39a4bff553648d0f498d204cad3cd4534e5981376a93552472121473efb06f36ee46ae7a965eddef189501b00eb0cdacf4fb01a072510a61e48c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d87d87327088fd0de41f74a51ce9bdc

SHA1
e8bc4a3b7398bc222baf2e1b93900d8755baac10

SHA256
483b4bb593953dc83e3702136615b0e2b9193df4a2d23c7df24db9046f442444

SHA512
83ff6d0a0beaf1fc449322244be66d147a57a6a79fbd939e6860d3d55a8b0181db03340960e353abc610aeaeef9cfda68bb6af99af3896614ee66569daeec9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9a0bc5390f731da907890e946f0d6c5c

SHA1
12aaa870677965dbc615d53086d4a8bf508d5bd1

SHA256
4d133699d2959af8b4eae7e903e7e155498de37b6affce3fb041df168c49778d

SHA512
68c3c82aba9a69fcc72472d07d848875fa2877d9f8f0aeeb3a9d197293d6b2222304eb5aff8cad14bb85e153e9c23912b37a9ef7600a4c9c64da10ab8b0f1b1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp

Filesize
915KB

MD5
ea8189d1e903680d2b90e3246d5718b2

SHA1
ade1766e4f58e1946ea09b58bc22bc5a84526eeb

SHA256
bf02189390189280ca82989bf8cbc93fef45d1b3ce4148402c507b767bde563a

SHA512
312c41ee3106f469c7621947d5c5b31a2ee5d2c898e207888cf4e374ef21dc8ab93e7ae11b9ff8affcf53596ed21f51c43896ea7d7d5a329e123ed6f3bde37ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp

Filesize
589KB

MD5
02aa25c3f6fde6fc911789776ef72020

SHA1
f7cd9d6887527cb9bc90594d3dd23246302a15e4

SHA256
705744da5358020e684f091beeb0375ceda605404ab9a789652fb2d67413cc4b

SHA512
4f513af29c660f2cbdb3eb3d8d1b2cdaad56b85299a4ea80be603a6c23058867ea86814140c103e399074310cd2d0bc5bf2af645ce224a9d9ff7859c98021094

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp

Filesize
182KB

MD5
1e2f09716fce8e5524243454d17d6f46

SHA1
733905e1c416c945c295288d737dc6cb9bae98fb

SHA256
7082f8613aa82e813ae19beaa2f20e9c95ede1b3160c148a94f572652e169f92

SHA512
3f49d12ef6cd810a31ae9f772bf856c7ccb3c758811069ba0c99b73f5525f5138b8baa114de4f62afad6b84def63e671e0ae36074d00bcfba1977ae7e704dcb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmp

Filesize
68KB

MD5
7b9b27d6552724637c9a81e2464d3e72

SHA1
fe67a5cc6ad1476fe3caf44775151421695259cc

SHA256
22851d020952d2c455a04733e99a0e4f7b521bbcfa2c7e9ab956eb22b8d38a34

SHA512
e18351cfd4ca7a4d65711562f0d233fa68953fe2a2142410f568fc92fbc18de4bdf4623c3e93800a7c38f4ce14391ad2bc2d768531764ba28f85c7d2d0453a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmp

Filesize
417KB

MD5
ca0535322f621eeec667bdcb27b47915

SHA1
a2b898d75126110b77ea0d5c209ee40424055f15

SHA256
fed0267259712bf670bb23128c4359d44dc6439c27e111f181ecbc2d0b0715f2

SHA512
d44459d6ca013c27fe2b5ee32d80bddb08c7f3bd11642826ac0bf40331c6a82cf94d5890ebe803ca190ce7b9fbe986c33d097c1349c7388db8cc759dd5e56ea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmp

Filesize
593KB

MD5
389175ac4af849623e5274f2d4e11491

SHA1
6820ea5967ae16f296d3b80b3397046569cd612e

SHA256
ad013834509c7b3773a7daa5aae88a54aab2077fe8053a6e24257c591505d126

SHA512
b59b84744432d314b84b2432b0041cae84e708fec3b389b5545319756861335fa464423d76a89516a17807ffa16fa0889ffd2477b38984166b5a6ceaa61aa3ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
73KB

MD5
81e5c8596a7e4e98117f5c5143293020

SHA1
45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

SHA256
7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

SHA512
05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL

Filesize
40KB

MD5
48c00a7493b28139cbf197ccc8d1f9ed

SHA1
a25243b06d4bb83f66b7cd738e79fccf9a02b33b

SHA256
905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7

SHA512
c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL

Filesize
60KB

MD5
4fbbaac42cf2ecb83543f262973d07c0

SHA1
ab1b302d7cce10443dfc14a2eba528a0431e1718

SHA256
6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

SHA512
4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL

Filesize
26KB

MD5
b845e77c476ae07f1d41ca094c3ae9d0

SHA1
ba32c96f36394fcf982fa6bad312417e1695fc15

SHA256
5ca3b2e4440c072236b620c52e79221638d14fbb68ca11a23adc4a4ae16d5348

SHA512
76ad58910c961035c6874e3e9c83b98f6fce7f2fffb932e9ba6424723506a8fe9df62e21fbc9ba2f157acb90b3cbdf25c1a4aa441eeb6a304a484495687929fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL

Filesize
60KB

MD5
9fafb9d0591f2be4c2a846f63d82d301

SHA1
1df97aa4f3722b6695eac457e207a76a6b7457be

SHA256
e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

SHA512
ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE

Filesize
268KB

MD5
5c91bf20fe3594b81052d131db798575

SHA1
eab3a7a678528b5b2c60d65b61e475f1b2f45baa

SHA256
e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

SHA512
face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL

Filesize
28KB

MD5
0cbf0f4c9e54d12d34cd1a772ba799e1

SHA1
40e55eb54394d17d2d11ca0089b84e97c19634a7

SHA256
6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

SHA512
bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP

Filesize
8KB

MD5
466d35e6a22924dd846a043bc7dd94b8

SHA1
35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10

SHA256
e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801

SHA512
23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF

Filesize
2KB

MD5
e4a499b9e1fe33991dbcfb4e926c8821

SHA1
951d4750b05ea6a63951a7667566467d01cb2d42

SHA256
49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d

SHA512
a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB

Filesize
28KB

MD5
f1656b80eaae5e5201dcbfbcd3523691

SHA1
6f93d71c210eb59416e31f12e4cc6a0da48de85b

SHA256
3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2

SHA512
e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF

Filesize
7KB

MD5
b127d9187c6dbb1b948053c7c9a6811f

SHA1
b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9

SHA256
bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00

SHA512
88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll

Filesize
76KB

MD5
e7cd26405293ee866fefdd715fc8b5e5

SHA1
6326412d0ea86add8355c76f09dfc5e7942f9c11

SHA256
647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255

SHA512
1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll

Filesize
370KB

MD5
eb312c0be773c732acd9ca0a157a2bee

SHA1
31ec6f11356e4276b19fb0fd7be4338917f2b686

SHA256
c5bf43f169223dc4ebc86fe8ad52f08c305b89d81fae9892a79d4391df312f5c

SHA512
12762b7722d8ce9c4498d4b1ad1b7f8d512a1ef97b4b3f79058f4513c5bcaa5b2616856d9371dfd7389644749f8c819ecdf848297e7d17737993186eb39089fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL

Filesize
2KB

MD5
7210d5407a2d2f52e851604666403024

SHA1
242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

SHA256
337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

SHA512
1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL

Filesize
4KB

MD5
4be7661c89897eaa9b28dae290c3922f

SHA1
4c9d25195093fea7c139167f0c5a40e13f3000f2

SHA256
e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5

SHA512
2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf

Filesize
29KB

MD5
c3e8aeabd1b692a9a6c5246f8dcaa7c9

SHA1
4567ea5044a3cef9cb803210a70866d83535ed31

SHA256
38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e

SHA512
f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll

Filesize
165KB

MD5
b4edaf7431a4758693f6fd36dc9a4aa9

SHA1
d070fbeafd11851591e13c4cee87879814726f09

SHA256
f74948f84ba6084aede23f4ab2ba3356aaa858c1e8c470ee22489a6c30301746

SHA512
1b046ce5b496c69261889c212d2c44e3b914cbe4655967645643c245ad035d7559ca35d2b19501b0115c91787df2639edf233f24262777ee75f333c92b72fe0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp

Filesize
11KB

MD5
80d09149ca264c93e7d810aac6411d1d

SHA1
96e8ddc1d257097991f9cc9aaf38c77add3d6118

SHA256
382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42

SHA512
8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf

Filesize
2KB

MD5
0a250bb34cfa851e3dd1804251c93f25

SHA1
c10e47a593c37dbb7226f65ad490ff65d9c73a34

SHA256
85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae

SHA512
8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
70B

MD5
d0137746bca9a48b82a9c520f7ea4ce0

SHA1
bf454a623bda2251b46dd0bcfeaaf6b47c33a766

SHA256
bbf0b41e8c270251bacbd9629c7f6fe92f47f7de8c8151ba78738c63eda2fc0a

SHA512
f0c1b1e11bfd07cf5934c105b43e39a7bdd7741a25a2ad089d197bcf0630a806e76414329dbfe6a1afb2b72674b500af764bb08a73b94df404f02f259af13dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe

Filesize
6KB

MD5
c203e138f460101f8af1314c0e817892

SHA1
13c2bc33e42e86e066d303b8596211d92a1a814e

SHA256
1d06c0e123142e3d119f5d865cba651d10c1b96a6fb44b68782b5f762ee16454

SHA512
ed9890756d06e0418223bda173c054839c407687c4f4cc0de63f7ef77a8872c146157c85be215b45f60636c7dfc2c815660d979b2f581408bbdae336428e045c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
150KB

MD5
e159856c839539c93cc3a6f5e7c08e0c

SHA1
25be9493df3a3bfe8d20c247349274322b344ffb

SHA256
f33c7d55e898f086899fc4d4838dd15bb71840ccab53f4e3dd0c915ebf2c1e73

SHA512
b15cbce585498121f14d94e2783e25d45f5065b0ce11e806349602e25d3d1a2e231f379125cd8b0d9605cf45a6357112b742858e1c1ebfec742ab90c98a2754a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
47KB

MD5
1a6b38784a8927646c15fa2f29eec498

SHA1
d3222af436cb11d1a0887863194499ead9e308d4

SHA256
8f31b4bf5e1c2e279e7a43dbf9e42bbfd56d6e4885e67bddca0a62fc03feb977

SHA512
b2ab5b78051da0c5d38932fdeb067f5f23ed29ab375d8df2a9bc3757f8ea2ab5a84c3421e72658f2392e3f6c877098cb7f292ed283fdf8c6575bc5917406f32a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
201KB

MD5
9066bf885cd72e46771654d0d8be15d3

SHA1
13afce866b59c99fa0319b7f204e6b6828d4b22c

SHA256
ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08

SHA512
ed55f1e9567c5076172f9037a6487fe406b0a87ecb7f8cc892a2e2d1cd9a2d832f7286d286dc90b85de34ecc0216309e5fe658c9c14cbaf07d4e1a4df42861ec

Download Submit
C:\Users\Admin\AppData\Roaming\dumps

Filesize
133B

MD5
0ba607775f404cc33716bdb3093f9a99

SHA1
5db80d896cd2d580ece150f712acc2a97368c983

SHA256
f5da923863c0a1cebb6925d620bac2bed6c42b4593582c037b506fca4d47a687

SHA512
a12390e7df81b438d7c50242848d134ebd5e1be2c4d884ef3e12f48579f3bf85c4dcf0c0e04c13246f42a688b6682c39bd0493a023dc4c9b3ecb540afd89477f

Download Submit
C:\Users\Admin\Downloads\Bonzi.zip

Filesize
1.9MB

MD5
e83538c2be77d2d16f11c8f27ee6abca

SHA1
1ae35a54873e3b5d41615c4193b5863fa4ae2d5d

SHA256
7ae59a702d5440a4332a912291f6d30f3d5962d76e0a507ea86eb3a6e55c7087

SHA512
aaba718f996700561b8d3ee69cdfa183e2a8e018184ea32246a6fc30a5627cb41dd60393b7f8661643ad138d6be711a3343f2ca7062517f011f486b65d838f7a

Download Submit
C:\Windows\SysWOW64\MSVCP50.dll

Filesize
201KB

MD5
102fc7544a2cb085a8dd197d60de71e5

SHA1
6d95dbd330e2ec930905254b525496d0c4dc7d2a

SHA256
ce1d1ff362269d3d55df9ce984d2722cca7a2884e86564b5668e020f1c2b9b80

SHA512
bd689e2f2896d292b9dfc510cf4ea2014a2ba2aacffe754219d25f060ca41517f24938bbddeef71d430f5f487c6151bc03aa9d80436de7403ad74d7ba687fcbc

Download Submit
C:\Windows\SysWOW64\msvcp50.dll

Filesize
309KB

MD5
bae25da8e3b080dfd6fd9596bba5e5fe

SHA1
829cfe72c5f786683cccb42a16602c2f70bfc56c

SHA256
c74fe1ab6b16a2b66dac79d8e1a781acdff552038078a97f8a2d6d8f1c82349a

SHA512
b604704ee3bf1299ddf619cb67aec76cbfc80cde51f8f11f8faa1938f1bc175bf095dd187a5fec597b01745170cdbdc9302979b7a6db90bb9d5057fdc7afcf55

Download Submit
C:\Windows\lhsp\tv\tv_enua.dll

Filesize
692KB

MD5
4358dbc1da14c5d1e975273394e5e72d

SHA1
dd094728d374dd6e681b0c20b316145ede711b73

SHA256
db4c8af3c4c6184f058644e509de02f35955f8add29329a3441756711b2c02a6

SHA512
2509adeec86d97b31c32aea809a4a0f663266e20c0d1ae1f14ae06d700d7afe8e90a0ed7402d1017d443135c18ef20acc22fec5915fb1dff163665e67b08b3d3

Download Submit
C:\Windows\lhsp\tv\tv_enua.dll

Filesize
233KB

MD5
e883f6eb980ac536b5025c92d7577529

SHA1
eb884baba095b628285cb082306f490e912eb8a7

SHA256
9a3e9f1b3cfeb69f9c200dbf5496e37a7e3e54ee60641a856c072e29e9170752

SHA512
7e5cdefeb37dafb1a5d9cdb1b4061a35aa42e5c0e0f61934784eea093e7139255ac738bbb3c7b1efa81a594c76ff58e9b3bb780caa5c9da990a22cbb28a5be0d

Download Submit
C:\Windows\lhsp\tv\tvenuax.dll

Filesize
40KB

MD5
1587bf2e99abeeae856f33bf98d3512e

SHA1
aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

SHA256
c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

SHA512
43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

Download Submit
C:\Windows\msagent\AgentCtl.dll

Filesize
149KB

MD5
b0f171db6283e0d589c9a5e50e4cd8bf

SHA1
a4a6f13c47dd012c1a4050fff593fe7c36c01b15

SHA256
5a99f06af5668acb0bc191758f8ee0f62a6b84c2aeb5f6c922fc0d839ad38796

SHA512
63f6af2b1c9772db8b8466eca7c100f6afe5c0b33865788179eb1ab97dd1dbb850036bbf91aad47a40529b1338f252ea1940d6d67e237aae4a203b69f14707e1

Download Submit
C:\Windows\msagent\AgentCtl.dll

Filesize
160KB

MD5
237e13b95ab37d0141cf0bc585b8db94

SHA1
102c6164c21de1f3e0b7d487dd5dc4c5249e0994

SHA256
d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

SHA512
9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

Download Submit
C:\Windows\msagent\AgentDPv.dll

Filesize
64KB

MD5
7c5aefb11e797129c9e90f279fbdf71b

SHA1
cb9d9cbfbebb5aed6810a4e424a295c27520576e

SHA256
394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

SHA512
df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

Download Submit
C:\Windows\msagent\AgentDp2.dll

Filesize
60KB

MD5
a334bbf5f5a19b3bdb5b7f1703363981

SHA1
6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

SHA256
c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

SHA512
1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

Download Submit
C:\Windows\msagent\chars\Bonzi.acs

Filesize
608KB

MD5
7212f14afc6ff28d241972efd4ff4e13

SHA1
de10cd9a8323d9f308a7a0971935d5703f364ac9

SHA256
b54363ea5bb3d2bee1a7f9403ec295288185bb73d8801fec9d5c03d1cb2638d8

SHA512
27cc330e238db2440b0ee408703d1c6657e84cf5819a7ea303b383d4105a06b4180ec4cf49bc671a13150954711f1a855873336fa13498375451f58a0f00a8fe

Download Submit
C:\Windows\msagent\chars\Peedy.acs

Filesize
551KB

MD5
b430990d6fbfb738b45f647623cc2f86

SHA1
f476c62b244913109a2e3e41eb2f6b987a4464ba

SHA256
876874c30c068f50632dbbb191ef5fbaf8ef10ec8776dd1b3f906c216d2428ce

SHA512
9392a48c35136ff485c611fe83c946a68e1d02d52bdd3703aeb0fe4d3e9800d289587f5108c7097156edd1e1b63597425ec8d94862a45c267fa0539a0211951a

Download Submit
C:\Windows\msagent\mslwvtts.dll

Filesize
52KB

MD5
316999655fef30c52c3854751c663996

SHA1
a7862202c3b075bdeb91c5e04fe5ff71907dae59

SHA256
ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

SHA512
5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

Download Submit
\??\pipe\LOCAL\crashpad_2488_WLOLYYCKSHBTTNNY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/208-64-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download
memory/208-63-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/208-45-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/208-44-0x0000000001440000-0x0000000001450000-memory.dmp

Filesize
64KB

Download
memory/208-43-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/1048-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1048-27-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1048-26-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1048-25-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1428-62-0x0000000001570000-0x0000000001580000-memory.dmp

Filesize
64KB

Download
memory/1428-14-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/1428-16-0x0000000001570000-0x0000000001580000-memory.dmp

Filesize
64KB

Download
memory/1428-15-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/1428-61-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/4384-696-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4384-1387-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4384-1741-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5228-50-0x0000000001740000-0x0000000001750000-memory.dmp

Filesize
64KB

Download
memory/5228-48-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/5228-52-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/5228-99-0x0000000001740000-0x0000000001750000-memory.dmp

Filesize
64KB

Download
memory/5228-98-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/6096-13-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/6096-2-0x0000000001060000-0x0000000001070000-memory.dmp

Filesize
64KB

Download
memory/6096-0-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/6096-1-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download