Malware Analysis Report

2025-01-18 04:38

Sample ID 230728-maq91sch84
Target Client.exe
SHA256 8575bbd6c6d677491401cf901173f5518c3169f7481dc426c283fba9d5056509
Tags
neshta revengerat mybot persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8575bbd6c6d677491401cf901173f5518c3169f7481dc426c283fba9d5056509

Threat Level: Known bad

The file Client.exe was found to be: Known bad.

Malicious Activity Summary

neshta revengerat mybot persistence spyware stealer trojan

Detect Neshta payload

RevengeRAT

Neshta

Neshta family

RevengeRat Executable

Loads dropped DLL

Modifies system executable filetype association

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies registry class

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-28 10:15

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-28 10:15

Reported

2023-07-28 10:18

Platform

win7-20230712-en

Max time kernel

124s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

RevengeRAT

trojan revengerat

RevengeRat Executable

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.vbs C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\PROGRA~1\MOZILL~1\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\PROGRA~1\MOZILL~1\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\PROGRA~1\MOZILL~1\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\PROGRA~1\MOZILL~1\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\PROGRA~1\MOZILL~1\firefox.exe N/A
N/A N/A C:\PROGRA~1\MOZILL~1\firefox.exe N/A
N/A N/A C:\PROGRA~1\MOZILL~1\firefox.exe N/A
N/A N/A C:\PROGRA~1\MOZILL~1\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\PROGRA~1\MOZILL~1\firefox.exe N/A
N/A N/A C:\PROGRA~1\MOZILL~1\firefox.exe N/A
N/A N/A C:\PROGRA~1\MOZILL~1\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2444 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
PID 2444 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
PID 2444 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
PID 2444 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1664 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2512 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1896 wrote to memory of 1076 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1896 wrote to memory of 1076 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1896 wrote to memory of 1076 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1896 wrote to memory of 1076 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1720 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1720 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1720 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1720 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 668 wrote to memory of 896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 668 wrote to memory of 896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 668 wrote to memory of 896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 668 wrote to memory of 896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1580 wrote to memory of 464 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1580 wrote to memory of 464 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1580 wrote to memory of 464 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1580 wrote to memory of 464 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1644 wrote to memory of 972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rikigtt5.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES477D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc477C.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lgu3dx3h.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES48B5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc48B4.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ym9av83c.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc49BD.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y6olqyj5.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AC7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4AC6.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-3z17yuw.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gggkxbpa.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BE0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4BDF.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D47.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4D46.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ga0aazod.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x5ps0cid.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E7F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4E7E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F3A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F39.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ozlc0e3i.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7dpelmsx.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FF5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4FF4.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES513D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc513C.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ref_8pjh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5217.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5216.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y3el-zfb.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES533F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc533E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ctmpbrmh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5449.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5448.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c-cjrc1a.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5571.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5551.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2f5y6pz2.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES568A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5689.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y-5x-2ot.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57D1.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1edhz6a1.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5977.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5976.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\alorqpe2.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5ABE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5ABD.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s20womac.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B7A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B79.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mfqxd2_3.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CC1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5CC0.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n6kjffks.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DEA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5DE9.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q2aqf_ra.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F02.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5F01.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5q4bu3gg.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES600C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc600B.tmp"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe"

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /sc minute /mo 1 /tn "Java Update" /tr "C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {95263FE2-17FC-401C-BF16-D24B4C273DC2} S-1-5-21-722410544-1258951091-1992882075-1000:MGKTNXNO\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\jusched.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\jusched.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\jusched.exe

C:\Users\Admin\AppData\Local\Temp\3582-490\jusched.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe"

C:\PROGRA~1\MOZILL~1\firefox.exe

C:\PROGRA~1\MOZILL~1\firefox.exe

C:\PROGRA~1\MOZILL~1\firefox.exe

C:\PROGRA~1\MOZILL~1\firefox.exe

C:\PROGRA~1\MOZILL~1\firefox.exe

"C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc --channel="1516.0.824546762\2062080145" -parentBuildID 20221007134813 -prefsHandle 1252 -prefMapHandle 1244 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\PROGRA~1\MOZILL~1\browser" - {5a0958f1-a054-4c0c-aef7-e572b72e8628} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 1316 e8db258 gpu

C:\PROGRA~1\MOZILL~1\firefox.exe

"C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc --channel="1516.1.732988528\14347020" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21077 -prefMapSize 232675 -appDir "C:\PROGRA~1\MOZILL~1\browser" - {c0d8c480-4900-4ec7-b6e2-4147ecfcce23} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 1512 d71e58 socket

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\PROGRA~1\MOZILL~1\firefox.exe

"C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc --channel="1516.2.103936198\911444418" -childID 1 -isForBrowser -prefsHandle 2068 -prefMapHandle 2064 -prefsLen 21180 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\PROGRA~1\MOZILL~1\browser" - {0b0531b0-dee8-45d2-807a-a025f62fe134} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 2080 191ab358 tab

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\PROGRA~1\MOZILL~1\firefox.exe

"C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc --channel="1516.3.1269580914\1924568200" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 26540 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\PROGRA~1\MOZILL~1\browser" - {80722b24-4f2b-45d2-bb3b-eb6c7f6ac365} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 2912 1b947458 tab

C:\PROGRA~1\MOZILL~1\firefox.exe

"C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc --channel="1516.4.549795115\182109113" -childID 3 -isForBrowser -prefsHandle 2924 -prefMapHandle 2920 -prefsLen 26540 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\PROGRA~1\MOZILL~1\browser" - {0f3747fa-db63-41af-b365-cad476fe6e1e} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 2948 d60c58 tab

C:\PROGRA~1\MOZILL~1\firefox.exe

"C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc --channel="1516.5.1231103273\157468052" -childID 4 -isForBrowser -prefsHandle 1920 -prefMapHandle 1820 -prefsLen 26680 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\PROGRA~1\MOZILL~1\browser" - {38b4d48e-bb8f-4f35-ba62-8385f7c79287} 1516 "\\.\pipe\gecko-crash-server-pipe.1516" 1120 d5b458 tab

Network

Country Destination Domain Proto
US 209.25.141.181:54077 tcp
US 209.25.141.181:54077 tcp
US 209.25.141.181:54077 tcp
US 209.25.141.181:54077 tcp
US 209.25.141.181:54077 tcp
N/A 127.0.0.1:49721 tcp
N/A 127.0.0.1:49998 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 34.208.2.63:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 209.25.141.181:54077 tcp

Files

\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

MD5 0885023dc9adce7d38eae97b51c20ca1
SHA1 c5511532f3ac3a3080e59880273fd253e1fb6658
SHA256 bd07f9e7ae9d87942841a7b48d878617f03eb59def338310455fbecba83b5d40
SHA512 6086127eaed400bdfe4111528605792f47350055de78b4d34a03fd7cc622fb107a31968523281639a9d5769e70e2db9b93314cb7f8c39445ce366b1a4ff1a404

\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

MD5 0885023dc9adce7d38eae97b51c20ca1
SHA1 c5511532f3ac3a3080e59880273fd253e1fb6658
SHA256 bd07f9e7ae9d87942841a7b48d878617f03eb59def338310455fbecba83b5d40
SHA512 6086127eaed400bdfe4111528605792f47350055de78b4d34a03fd7cc622fb107a31968523281639a9d5769e70e2db9b93314cb7f8c39445ce366b1a4ff1a404

C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

MD5 0885023dc9adce7d38eae97b51c20ca1
SHA1 c5511532f3ac3a3080e59880273fd253e1fb6658
SHA256 bd07f9e7ae9d87942841a7b48d878617f03eb59def338310455fbecba83b5d40
SHA512 6086127eaed400bdfe4111528605792f47350055de78b4d34a03fd7cc622fb107a31968523281639a9d5769e70e2db9b93314cb7f8c39445ce366b1a4ff1a404

C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

MD5 0885023dc9adce7d38eae97b51c20ca1
SHA1 c5511532f3ac3a3080e59880273fd253e1fb6658
SHA256 bd07f9e7ae9d87942841a7b48d878617f03eb59def338310455fbecba83b5d40
SHA512 6086127eaed400bdfe4111528605792f47350055de78b4d34a03fd7cc622fb107a31968523281639a9d5769e70e2db9b93314cb7f8c39445ce366b1a4ff1a404

C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

MD5 0885023dc9adce7d38eae97b51c20ca1
SHA1 c5511532f3ac3a3080e59880273fd253e1fb6658
SHA256 bd07f9e7ae9d87942841a7b48d878617f03eb59def338310455fbecba83b5d40
SHA512 6086127eaed400bdfe4111528605792f47350055de78b4d34a03fd7cc622fb107a31968523281639a9d5769e70e2db9b93314cb7f8c39445ce366b1a4ff1a404

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

memory/1664-68-0x00000000013C0000-0x00000000013E0000-memory.dmp

memory/1664-69-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

memory/1664-70-0x0000000000A20000-0x0000000000AA0000-memory.dmp

memory/1664-71-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/2512-104-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2512-106-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2512-108-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2512-105-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2512-109-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1664-111-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

memory/2512-112-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2512-114-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2512-132-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2512-143-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2512-146-0x0000000001F80000-0x0000000001FC0000-memory.dmp

memory/2152-153-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2152-155-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2152-157-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2152-159-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2152-163-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ytPcYBG.txt

MD5 6f2ffa5b1c642d434af5e6fdf078c095
SHA1 73ecf0869259a9b6467c9eb184e591e677882d3c
SHA256 3c91c69e876ae0587f613667c1b21acf7896f9059b3b77de8c401cf92e3674ef
SHA512 e1b7a7b3b639915b76d3311c9d9fa901a9b6eb57a1184fefb211903cb14c009e5616531e1ed620f2e5d0aa1d33cbf406e1bb1635521eb68503254a304a8830cb

memory/2152-168-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2152-166-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2152-169-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2152-170-0x0000000000390000-0x00000000003D0000-memory.dmp

memory/2152-172-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2152-178-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2444-179-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2512-180-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2512-181-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2512-182-0x0000000001F80000-0x0000000001FC0000-memory.dmp

memory/2444-183-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2512-184-0x0000000001F80000-0x0000000001FC0000-memory.dmp

memory/2444-185-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2512-186-0x0000000001F80000-0x0000000001FC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rikigtt5.cmdline

MD5 0ffcd0ddd9934325fc827dcb346e78bc
SHA1 adcb36f784113cf93089d637201c2b26ad0225b1
SHA256 e2505e14b38e6e1797b4732591c079fb6dde9f5f35e14a473c964fadbfc0e147
SHA512 6d71e9efa844c37847e319d844e253b7365f7a796ab50a2719dde85ba5241aae12b9f651fcdf70f48fa76f64f1dc50fc153afb438e6119bfef37dba5b7f0182b

memory/1896-194-0x0000000000660000-0x00000000006A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rikigtt5.0.vb

MD5 53724854f7e8d6a91468ab0fcff397f8
SHA1 d20052511341eb3354bab6058c2e83cd82448c2a
SHA256 b7547c3645a47bec8afc848b909a6d5a54d87ea466fce52fd905cb04b0c713f0
SHA512 d1253c76549367cb26c8f6071f6ca127096fc6eab9ce50bf9eec60b717469e66feb3d0b1bbe8c8fede9dbc510380aa302bbe015a72c6eb62b11e1a578a81c550

C:\ProgramData\System\vcredist2010_x64.log-MSI_vc_red.msi.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\RES477D.tmp

MD5 aba5ce3d64e672d2e5dc5217052ed422
SHA1 b22937138d061e6667f5cd45cf20443ba9ce0d0a
SHA256 9679df5fa71f8ef2575293dd9949bcc4ee3d6ad61a4337831baa8be194061621
SHA512 639578b5a69aef8cdb2703770920d7c77326f255cfe4a6813e3f223ea270d662745d41c8334fe286f5de9ca3e14b2c652e68e00560284c03b7b471596ad17b71

C:\Users\Admin\AppData\Local\Temp\vbc477C.tmp

MD5 50a95a595bd608163c9c8d907e4a8b5b
SHA1 29da1f22d849dc0d765c688e4d8a159f4976cf15
SHA256 70cf5006a064e01785a9bb81c2960c19cfdfda5b22e6ac32c37888768f530644
SHA512 f918b9530af57f3211ccf8a2e69b0778a530dd89d1bdd6d525a191322c7533cd7cdcc4825e7c9b274228d315453e16f1efce7a7159070f36ad92ad1319d755fa

memory/1720-211-0x0000000002190000-0x00000000021D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lgu3dx3h.0.vb

MD5 8e16faf47e4f44f34bdda0ca76371b32
SHA1 0decb820571e61ce49c277e52ef59122ea69c89f
SHA256 a914de02b6db3e60cb09d4df2943ee93bb732aae6cdd2bd8a998f0eaa76b9637
SHA512 9869ceb38e13852569b6a882c2afa627d4115ec4265e94c89ac933bad5395c13dacfef0a5aede9b47cd16f21d065e5c77087dfc852b591ec98249a0b032b30ed

C:\Users\Admin\AppData\Local\Temp\lgu3dx3h.cmdline

MD5 3d39fcae348f9f7271e6df68233a7cc4
SHA1 666e86dc7f9ae2b89901eb840194177f5ca69a86
SHA256 a54f48b65c37dc9e373b167c0220601458c8cd3199df0a5f1e0191a2d74fc9ab
SHA512 6e0efe392e89b3f5e79faa9680b98677776b05d30abf64e62271bdcefb9280281889fe625061cccd451c8a0fb0ea3f2ee9a8f38d5cd67b4450ec07a071322412

C:\ProgramData\System\vcredist2010_x64.log.ico

MD5 cef770e695edef796b197ce9b5842167
SHA1 b0ef9613270fe46cd789134c332b622e1fbf505b
SHA256 a14f7534dcd9eac876831c5c1416cee3ab0f9027cf20185c1c9965df91dea063
SHA512 95c7392ffcf91eaa02c41c70a577f9f66aff4e6a83e4d0c80dbd3a2725f89f90de7ab6484497bf6e0a0802fd8ced042647b67c5ea4bee09e1b2be30b0db1f12f

C:\Users\Admin\AppData\Local\Temp\vbc48B4.tmp

MD5 1f4cf8d25e01f0c129fc5e1d2dc8fcb5
SHA1 ac0a158f0f168ed842997e62feb5e237b89e6bad
SHA256 63287d394194ff77e8f36122dec660f872466271b10143a42b4fcedb03170067
SHA512 5f1228b33ea3dbae10ab158a87ef5586b32bfb30f96b58bc3422a4207fad7b6370a9c33a9d7553e18490eccbe936a30f472f9b779736cb5bcf2f0b0c92f5c535

C:\Users\Admin\AppData\Local\Temp\RES48B5.tmp

MD5 41ff8f7509d353c676a77b3fa46677fd
SHA1 c0c943e474e41cb11569063872f6d69113a1641f
SHA256 823d68b99f3e5bcfd9212611aba88f1f0433afb15363490feffb28acf0e7a50b
SHA512 39c1a93f270791b0b85295924d71afa4c2db93e07ee6834cf6ee35ca9f3604859debace83344b0330f7b38f09dcb529a6cbf5f54a3a389e52556bf0e178656de

C:\Users\Admin\AppData\Local\Temp\ym9av83c.cmdline

MD5 bc992886aa8b60f251d77db8c822202d
SHA1 2a9fd34f86cb424709980f3096c422c1bc14df3a
SHA256 990eceee9c3033d0a4fb1c5e9f1c49ea758f54cbbd0c09551c362d886cf5a0f0
SHA512 e50639d2d879c5e2b010b477020ee8245fa7919bac2499627eac209f97544e45da5ec11512ae8f0e2d69f2d5500842ff6853565f9d96436e37365298f71751f3

C:\Users\Admin\AppData\Local\Temp\ym9av83c.0.vb

MD5 a60d2f8e589f5481b18086d6e02643df
SHA1 606a8a77bb56e0a52e5264d9e651d0370ec2e0a8
SHA256 4ef7c1933078bdee438bf088c99b9b09917983a35a03723ac7ddcfd2290a9bef
SHA512 2ee4fea191952ea6b1f5f11469b8ffbfd546fc7b3d69e40bfb46504c07623047197b7420265b6476303b03799dfde9a0d747135cf8c88105961e535f34bbcb18

memory/668-227-0x0000000001FA0000-0x0000000001FE0000-memory.dmp

C:\ProgramData\System\vcredist2010_x86.log-MSI_vc_red.msi.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\RES49BE.tmp

MD5 864ab0420470c860196e07bde5ff9dbe
SHA1 5db7e026ff15cba0fc21ace72be601115263a83a
SHA256 d652121aa640ee74c1c37b652f135c4188f8912cd80abfee1146cb75f5aa7ef7
SHA512 ea17176926b733a3b434adc45af049d469e55f705defc79890099e39e3b7654c5d6d4d62b935c5f5a9f5a452e04b5cc570df103c664b6c2d54c701927bf80df1

C:\Users\Admin\AppData\Local\Temp\vbc49BD.tmp

MD5 dce7226002a4b72467d377d068223261
SHA1 2540dffe7f3952a4002cf6138cadb987a5695b0d
SHA256 89b0f5a84d236d4239feb61b76f457c9fcf847fa3bc75e0de654883a51e2a328
SHA512 38d8944d0028276109ea2613051c0a48be3447d2a51cdb04771f525491d835e95ee7229e5c2c5028917afc56c7eb65e16e8485f7c050ec3aff69b7b1a201eb09

C:\Users\Admin\AppData\Local\Temp\y6olqyj5.cmdline

MD5 b171015171058a9c05a62d83b0a3d9bd
SHA1 ca28aae204f2267531ec13a1ef00b4feb25a840c
SHA256 06a62b8159bed12ec8d784a8207d91ba61ed1add46ce7be35736899e340a4f0b
SHA512 84b0041eeb33307917aa9aeada59e0d3e9d810da09700d09a0562f703e46bb0dcb25edac3fbd69823d94cd874a20673f13ba7a77338989ff028a376faedfd564

C:\Users\Admin\AppData\Local\Temp\y6olqyj5.0.vb

MD5 f4b10e99092b9d7f56a557ffc64576b9
SHA1 b7c31791af47129f6c85d8a83b65c7081343d98f
SHA256 934c206240bc907f76775a5db8ced6ffc096c666dc9a059df52ad17f4a949d19
SHA512 2e4b5890498912abd5b1c10bc31418ac9fa7af35a528a63d373ae1295699ea477f70f3d7f55cf452b36c19ab6d1945d3db42f78832cf864dec7b2238b52b650a

C:\ProgramData\System\vcredist2010_x86.log.ico

MD5 cef770e695edef796b197ce9b5842167
SHA1 b0ef9613270fe46cd789134c332b622e1fbf505b
SHA256 a14f7534dcd9eac876831c5c1416cee3ab0f9027cf20185c1c9965df91dea063
SHA512 95c7392ffcf91eaa02c41c70a577f9f66aff4e6a83e4d0c80dbd3a2725f89f90de7ab6484497bf6e0a0802fd8ced042647b67c5ea4bee09e1b2be30b0db1f12f

C:\Users\Admin\AppData\Local\Temp\RES4AC7.tmp

MD5 e4ab76d2bbcab27172f184409ab52e31
SHA1 961662649e886c601a64dadf16c986ab19011efa
SHA256 b5bd46e3cf4d4104061c6d122e330694da06cfc7d454127b7893172bf3202656
SHA512 8ce02ab04e5fbe4ef539129dfad05823aca36abff80bc4825999b3a84cc7d5be1d0aa02a4188f3cea56154626b263c12fdd5e5016e4ee39db3e1980e7105cffe

C:\Users\Admin\AppData\Local\Temp\vbc4AC6.tmp

MD5 cdff953419a211bfc8c14eef01c6629b
SHA1 4498f1940428e65f21234d6b7db13bcc70d43787
SHA256 022b1405211f53904747fd6622091e0d32de44e9f754e7bb687e5666e1cb5a68
SHA512 1f0c9d608e4ddbe15261e0174ecd421124c6a8a92fffa0817eb7d6759887dd3049c4c005189e1c3ff9a8af34a988acaff74c7d6cd26db64a3c40903f139b1db7

C:\Users\Admin\AppData\Local\Temp\RES4BE0.tmp

MD5 29faf8bed1c3eaf1f9ac66c37ae4c5ee
SHA1 8e8bb4bb267264668c9a5fbcb3e349c1fd6a45d6
SHA256 f236d065d4d7357b23b8a99ea8f0a57cf13f8be4c85bfadf516f99234180c429
SHA512 6cdbf5632a2e1b664126b79374bf14764292d96ee74de30771b6de51a6b3b0fb1b68b2d4ae25ca1dd5612d962be5873d18885f8927259a9bca908935f68cba5b

C:\Users\Admin\AppData\Local\Temp\-3z17yuw.cmdline

MD5 13179d32795c5760f3f79f52b795d6b6
SHA1 3be4f93dd2c6fd33d5cd6ffca7d07fc0ed72bef0
SHA256 80bacd84f442831e7ab0f4a568b57b16b4dab610e89dd048fb01f29961e5ee54
SHA512 2c6f80322de6dbc86b8dcc6ef4c14a040a197f49b38feba954b7462bc7e77e0c7734814508cb05a26e0c08231fc76f46f6ad857698cc029f53fd623c4fc29a5a

C:\ProgramData\System\vcredist2012_x64_0_vcRuntimeMinimum_x64.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\-3z17yuw.0.vb

MD5 16d1f461c8fb6826f93469f6deeb7dde
SHA1 92817e35421454c00dd2b5c08d6b745de5dde174
SHA256 0ba3a5d7baeadc78bd1b15ee9aa4d98135d30562e7060902f54e8da6cee6edbc
SHA512 3a1d9965f828c8485d2e752d7e108233141de1598775d568f033c1cd5b26081d16cc7e276a2e85a654106f4a60fff94b92b77d78ee9cbf041b14ed80bd3a467a

memory/1644-257-0x00000000005C0000-0x0000000000600000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc4BDF.tmp

MD5 23ccfc9f00b43f84ca8899ffd165a806
SHA1 314017338cb04d44af7ed81c2655d4e92051f26c
SHA256 ffef9ffa0ae96e6bddbe2c4b7d157d11874bbf1f2b5ec70fd805b262b8d7c347
SHA512 c70ce89954b08fd810d6e5f8b8c11a285af3e68a36b9ec6e84ad02d5fd323597575e67f863a4e73328e2b6d5f4e6d498434adbd824abbce31f627da6f7056f86

C:\Users\Admin\AppData\Local\Temp\gggkxbpa.0.vb

MD5 861747f9ecfea1cb3e18003ad314ac65
SHA1 16d433a6f29d76adfa8b0a9cfc65145fdf5bd461
SHA256 31c120da419b1829d5f372f30df1b1fec1d7a93dc1ee26b5787113fe428d7369
SHA512 d7aaa54e0715455a5bd57a92e05cd749b150782ac614741f42725974ed2256243d025b097dea7c35a968bf2f0a56aa5a46152d807cc2b7111540c180de4b2d4d

memory/2344-273-0x0000000000A50000-0x0000000000A90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gggkxbpa.cmdline

MD5 c95d9ff248794d22df5eb81f517a1362
SHA1 8b3894a3a4353fc22dd26f4fe70549360d3292e9
SHA256 4c0b3501fa0f01b900746b01926fbd2d24f4ae711baa112627b9d4a04e760d81
SHA512 cb5bef404acfe8ccb73fd9adc58dd3c8cec55956159cbf6d434500cd32aebd17f514b07848c138d92828082497502f0ad0c33d442160734a9092f83f74af60d4

C:\ProgramData\System\vcredist2012_x64_1_vcRuntimeAdditional_x64.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\RES4D47.tmp

MD5 1f3c4452e733065b4cb1431bf07d3440
SHA1 f186c15f56462eea953224bc72e3ebca307b1e7a
SHA256 eff5ffaeea5dd7e26dff279331f628f2d4bf278466edb9f1394d27e1121c75b6
SHA512 1523d7767fc7a8f5336584463c2ec915b951180e75cc41c5404727513fd11787ddceb57bed8d7ae5563b729f69cf81f6d6ae1cfa046d506e05484bf8a385f977

C:\Users\Admin\AppData\Local\Temp\vbc4D46.tmp

MD5 6f39c05266fa43f526d8bfa3bdcda6a3
SHA1 9afac772dd7ce34a26abf25d9f2a05d530f9ae2b
SHA256 20cd6fa623faab5260152b1bd0cc36f4fc7f0ec804e5552069b1647e3c153189
SHA512 6aee2abfa0219dc675eaef70b02b86f408d85798ddfa412682a9d3e8269adae44957fcc0d77e94aac51718aac7c0f6b661e200f9cb23870c1e92f560dc200d1c

C:\ProgramData\System\vcredist2012_x86_0_vcRuntimeMinimum_x86.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\ga0aazod.cmdline

MD5 059bfaecee9ed1d3dc401e8cde64e357
SHA1 c3f90cf9679918d387a969614ec3245ba10a557c
SHA256 e8feadafcdf6187745a65d184cbb948113990e875ed289fea85c0b9e50b85ff4
SHA512 579bebb64da2eca4597639093eebd64225d4b4c3798aa8cd1e56a6a19c693280cbf0c1625767b70134295fe38d83e586c9432904a0bb5a1b57695911d6cdb86a

C:\Users\Admin\AppData\Local\Temp\RES4E7F.tmp

MD5 d481c71e69dee428c3740bf829484ea6
SHA1 b940e5576e54e05f24bf783a883f6ea49cf24148
SHA256 4a6183004a148fe50c31981b3af17278a3247c2a4077a6153bc7e7ec28d2e5c2
SHA512 f758c687c060e3d13e5ead88027ee1b97e2dc7b935d6487cb61c97212ec094f0d65b543c07fa3c0beddf2766f31036f4f08308451f31b7e6c24864440cbc1826

C:\Users\Admin\AppData\Local\Temp\vbc4E7E.tmp

MD5 b2fe986b381d13e48d12f753e165af88
SHA1 d0bc2d829c551bb82b01c34a4abc987b5d9842c2
SHA256 27c0588cd1213f50f410a5934f609304caf7b12ad6895d0c611c781c837e67ce
SHA512 aceb6a7213de003de47ef5666ab8a2baf216ef60bf79c9b6437ff67d027f3229cd01c234b92d05fb4b0e9974c8edc7a4ae89e3b044d011b6da5d5950f87b5bcf

C:\ProgramData\System\vcredist2012_x86_0_vcRuntimeMinimum_x86.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\ga0aazod.0.vb

MD5 097412466bc4f4df91b98023bb61f805
SHA1 a32cb822f8802ab20e93c497c6ea17e31c2683fc
SHA256 68b39e3a1ef55c2bb9f0662a85fb4a96994d9478abb9077d4a7f7ab00c823625
SHA512 4ef58afeea165fe9c1c4fdfd3b0419590a1043ac91e7e4a3e697726f0f26768ba1ea2033ea3b251c2d6432dd9fc412b2e2c757418aee1ba8d12d6d19cd14be5e

memory/2240-294-0x0000000000380000-0x00000000003C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\x5ps0cid.cmdline

MD5 5f7597d112895cb0164195b63faedfb2
SHA1 87141737c296cd3846e54567274bb81eb166be8b
SHA256 8c4a7c16996c042ac554e415b94f01ad748d034d079ef4746824fb776267a35a
SHA512 3ff99ca49e1f4504c6b1c023925ebd0d2a996a4cccb12abb8b14993a3b49d87012913877a349c8a204a2bd1b367ce8f32b42ab1348b16f054331dd4401562c3d

C:\Users\Admin\AppData\Local\Temp\vbc4F39.tmp

MD5 e1a6dd0b00877b7dd628be776821a999
SHA1 8e1257eca8e218d48204935355e2333706a68b4c
SHA256 f081a04ab3c12908aee3bf8a1dd967faf80ac25b0ae03542cc7fca9a739218db
SHA512 7ab3233330b1d43cc9c12d772ae5229f7103b9b066c5e37e2ce2a589a478678f7e9ee0d4f5b2e642393b45967561ab86e740f42aad92c792edc51d0cb0ecb520

C:\Users\Admin\AppData\Local\Temp\RES4F3A.tmp

MD5 5d6669649465f5c52f80c6a640fa557e
SHA1 2771f7bf2e41261fef6229b8f42d616b8f2d49a0
SHA256 98096b4060d423560b1d5f39193ca913df8abcade28bc40371fc1ff6a0674961
SHA512 c41ec9a890312d5aa06501084b652a562c08682566be5aa4dbee61eeb75a8fd7eb76fc2c5dd42a660dffda4f9b9f6034ec5b9424a3ea6258baae5292e45e34b1

C:\ProgramData\System\vcredist2012_x86_1_vcRuntimeAdditional_x86.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\x5ps0cid.0.vb

MD5 1cb6bf5c7ae5f9c9ea2bab8509ba020f
SHA1 8768e9cab09aeb664a4282d62b4fdc78d1a890cb
SHA256 9d63b8abc15ac323a28b7b63770369001223b6d9f82a6e4a5f2193816db772f0
SHA512 91041c7eef34f08aa69847a0a13fddbdac8afca51f09b3463d245672ccad847090443cca21ce708d9819af934d091a6569033ddc6547d61519094e1fd34f0005

C:\Users\Admin\AppData\Local\Temp\RES4FF5.tmp

MD5 f5a78ce5edd936a08fe2d5d453a5d82a
SHA1 a3bee927932201addaaa2de0ae9bee7fdc7557b1
SHA256 fbb4f883321500207912f36e7b42130906182a44f3743746c291fdb3228e425f
SHA512 e71daf8dea8a798c85f70437954e70176bcd7852d29a5f1364a00375f050b2262282d385fa2bf0ac89c33326588921e43ed8d831f1ca7a43e658ba435c237a91

C:\Users\Admin\AppData\Local\Temp\vbc4FF4.tmp

MD5 a3398419f0414c94eeb99c048bf4932a
SHA1 a96ae5711237568b948443be9690179c4465edd7
SHA256 b0c39da01bea228aa36e02569205312fa75d1f211006029c5984291a1875a310
SHA512 bdd31c17566cfbc485554850757fdd05fb9048a5d5b076385cd07d71e36989ce3ba05eb044317084c1781020495dc053c615a1d4aba278955134390d91b9afcf

C:\ProgramData\System\vcredist2013_x64_000_vcRuntimeMinimum_x64.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\ozlc0e3i.0.vb

MD5 429c4a0cd3297a18947bab4aa5d82c95
SHA1 89dbf5e142081957465d8c616da314ee6c91b61c
SHA256 0d7af6efa80780fde632cebfbf9db364ad826af5db750135d8bbb368b6880dd3
SHA512 5c5afe0a6ab92e697b4848621b7c3f491bdfd2a30775e1bceb9378e3d0de0d9732120fd981e1423b21afab22a8f1d1fd428f197864b6ec85506695f716356349

memory/2220-320-0x0000000000390000-0x00000000003D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ozlc0e3i.cmdline

MD5 2adb82f1ce70b85425a8e8d7c27b1308
SHA1 ea49dbb066e1a25833e89ac53e15fe9d5ae8557e
SHA256 bcc9341ffd09c3d60395fcefc414eea2c361b8d05aaecd7bf128a721e2f078dd
SHA512 e21259cd102a228b32bb9738242befc0cf67224194616d3f836b28a3cac53a90fc8ede98235b80463c461236514bfc3393b77f04d7abf10f68f59804fe245064

C:\Users\Admin\AppData\Local\Temp\7dpelmsx.cmdline

MD5 9443d8851533ed24093280c6e37d2557
SHA1 9eae31b08506896e613930f75b94842573d4f6a1
SHA256 f1dba09cb05145fc4da7f91870c536778f963e891a1fa7135df3bad679982eca
SHA512 7a730852a94a2284a2923bfe88ca24f97c3fa5ef8f0dc9d5133e4bea2fac8f07107621fc87416800e1cf2aba74fe825bb205ee3d489e1237611221cc612145c7

C:\Users\Admin\AppData\Local\Temp\7dpelmsx.0.vb

MD5 7ca18a8649db2b2a82566de73de9785c
SHA1 1184193705a5902fe7a3a7bb3731b09f7152802f
SHA256 3937b4fb7ef24a51659b32c25ae62c076fd5fdc3dccef25143bfdefb04e732da
SHA512 7487597cccc795935a4c0fde3459158c772145d87d81a1d76e940b851d29c1b8f4431c8d2b144f2d18e27b506e524f263cbf76c394d52e0d235547e5650e98f0

memory/2416-336-0x0000000002170000-0x00000000021B0000-memory.dmp

C:\ProgramData\System\vcredist2013_x64_001_vcRuntimeAdditional_x64.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\RES513D.tmp

MD5 f0c85a925bf97df694ee60f17fcc2c88
SHA1 5a24fe046e7ea074dd79f8d9e2c1e73a148df170
SHA256 de51398725afaa1cc2deaa518b7020faad198e43da91a8a219480f2898c5b240
SHA512 ddb13dc997e4e4d8ae21d53b31913957c871f402dd2f896128c366e3103aa622e80a77b39eeb5a90d1bb68c3789faa87f0ced433a402508691c7d26b4c6a5815

C:\Users\Admin\AppData\Local\Temp\vbc513C.tmp

MD5 72d8e0fbc445f3d06cd13994c3e3b7a7
SHA1 6f24f67bf021d025452126b1c3f62ca4e7331caa
SHA256 ff12dfd8bc0d45a15ffc51f04b01762361352e566717fb14da08b41f480ac82a
SHA512 5d6e2cd929c62899fb529a766f2d7a250cebb95f592d534036ee5776b148ffc8acf7c6bcd5ebf3c6b74434922a6865864d442ee38904c217dda015ee11591c5b

C:\Users\Admin\AppData\Local\Temp\ref_8pjh.cmdline

MD5 99eba6fa8a227c300c12df188bc7e39a
SHA1 fd7d20ad09f3e1654501f33e1a1fdc2f5036c8d4
SHA256 9b6ed33698f975319719fb942deaad638858cbaed98bede34741aa838096ba55
SHA512 a225367e936516e8527e193b1583c0bc1feae06fcb34f833832f5b6e4f0d33b6a739d0143c7c67193933f8d17fc52e8bb1f2a5ff1edc73f2754d31a87ae7f347

C:\ProgramData\System\vcredist2013_x86_000_vcRuntimeMinimum_x86.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

C:\Users\Admin\AppData\Local\Temp\ref_8pjh.0.vb

MD5 25fde15b585f88d0076eddf52829011a
SHA1 a6b92b5e16f000223768f47b416c60434a8de58d
SHA256 22020e960f4e23aa10b11437fb549c64eba056ab9fcce51989c5537003f95a21
SHA512 4c5b1793613260dbc2fee118942dd46f1f567f25f31b9ed84648eca02c75184dc3c572d0c3e5a4e6697c7dce6cdc83d9b315049e4302bb1e6edf5542731c3110

C:\Users\Admin\AppData\Local\Temp\RES5217.tmp

MD5 dda0c00be2d9988b57b3caec0faa8f41
SHA1 282f9c41eec81b36247765385f1835722a01218d
SHA256 1117724c5a2c400c2fc936978eb2924af6b7a3e48f38454eb8344cb3f31c13f3
SHA512 941884edf3ef844dc84160987aaae21a492901088867a2ba0ace5725d74d63820ee177b0940629700dc565896c9b61ffb1e48856bae14ecaed744cbbb6e04bc5

C:\Users\Admin\AppData\Local\Temp\vbc5216.tmp

MD5 762ee0fe9f3affe3ed410bc9d1d3dde3
SHA1 ecd21f868442757424491219c794d0acffd78f33
SHA256 262e9ae70c6176b22a2c31efda39dc5e81f66ff31205b2223c094192cb4a1078
SHA512 bbe51d6462f8fe7e4cdf5c992b702f2fc95097f82e8308efac8b123042c5651b461905cfeda19a940b55ce5ba276d4ff00bb22692a39ea0b30b0d54669753db3

memory/592-357-0x0000000000630000-0x0000000000670000-memory.dmp

memory/1576-369-0x0000000002200000-0x0000000002240000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\y3el-zfb.0.vb

MD5 a9f22783857533b285c901a932e18a62
SHA1 f29b39e1225f407033f1e7a6acaaf0ffe2afd05f
SHA256 bd4786737d36c021edc664ddeca25483616402a353f595a0c66b54180a8add96
SHA512 b215ba51f63dd0034868203b0b67ebb1c9ee9dac8b4448612e18b7593bf176ba4347831fb09a9988c308349a991e8bd8c4fc7a5cde7d0161b855003c99e60698

C:\Users\Admin\AppData\Local\Temp\y3el-zfb.cmdline

MD5 311a14b5e268d219248fcc29c5b6f8ce
SHA1 997b5cfab797e5993937541d0c92da92186a3f70
SHA256 6c977b09080cc866d3ae1f1495e8ee573b1f45126b98a930dedf8dc8c7e32ff3
SHA512 1dbb79253fb59e1d4b14caccbd3c4ef39303d0fd59dc7ab5ad8dd1c13e2e19e642737087faae770ff0d82cf70e0f639d657105f9473e318f31d4cefe9a31a972

C:\ProgramData\System\vcredist2013_x86_001_vcRuntimeAdditional_x86.ico

MD5 c398ae0c9782f218c0068cd155cb676c
SHA1 7c5bb00a34d55518a401cd3c60c8821ed58eb433
SHA256 9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3
SHA512 85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

memory/668-381-0x0000000001FA0000-0x0000000001FE0000-memory.dmp

memory/2880-385-0x00000000005C0000-0x0000000000600000-memory.dmp

memory/2648-393-0x00000000020B0000-0x00000000020F0000-memory.dmp

memory/1900-414-0x00000000003C0000-0x0000000000400000-memory.dmp

memory/2240-425-0x0000000000380000-0x00000000003C0000-memory.dmp

memory/1896-429-0x00000000002F0000-0x0000000000330000-memory.dmp

memory/2964-436-0x0000000000350000-0x0000000000390000-memory.dmp

memory/2444-446-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1880-456-0x0000000001F90000-0x0000000001FD0000-memory.dmp

memory/1368-466-0x0000000000560000-0x00000000005A0000-memory.dmp

memory/1968-487-0x00000000002B0000-0x00000000002F0000-memory.dmp

memory/2012-499-0x0000000000900000-0x0000000000920000-memory.dmp

memory/2512-501-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2012-500-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

memory/2012-502-0x0000000001FE0000-0x0000000002060000-memory.dmp

memory/2012-503-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

memory/1608-508-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2012-511-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

memory/1608-512-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1608-514-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1368-518-0x0000000000560000-0x00000000005A0000-memory.dmp

memory/1608-519-0x0000000074BA0000-0x000000007514B000-memory.dmp

memory/1608-520-0x0000000000370000-0x00000000003B0000-memory.dmp

memory/2444-522-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2668-531-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2668-535-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2668-537-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2668-538-0x0000000074BA0000-0x000000007514B000-memory.dmp

memory/2668-539-0x0000000074BA0000-0x000000007514B000-memory.dmp

memory/888-540-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1608-541-0x0000000074BA0000-0x000000007514B000-memory.dmp

memory/1608-542-0x0000000000370000-0x00000000003B0000-memory.dmp

memory/2444-543-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1608-544-0x0000000000370000-0x00000000003B0000-memory.dmp

memory/888-545-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2444-550-0x0000000000400000-0x000000000041B000-memory.dmp

memory/888-549-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1608-551-0x0000000000370000-0x00000000003B0000-memory.dmp

memory/2780-556-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2832-562-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/2832-563-0x0000000000220000-0x00000000002A0000-memory.dmp

memory/2832-564-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/2832-565-0x00000000001E0000-0x0000000000200000-memory.dmp

memory/1516-577-0x000007FEE80C0000-0x000007FEE90C0000-memory.dmp

memory/1528-769-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2360-857-0x000007FEEFBE0000-0x000007FEEFBEA000-memory.dmp

memory/2360-862-0x000007FEEFEB0000-0x000007FEEFFF3000-memory.dmp

memory/2832-1060-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

memory/1292-1062-0x0000000074BA0000-0x000000007514B000-memory.dmp

memory/2832-1068-0x0000000000220000-0x00000000002A0000-memory.dmp

memory/1292-1070-0x0000000001E20000-0x0000000001E60000-memory.dmp

memory/1292-1077-0x0000000074BA0000-0x000000007514B000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g1epp91b.default-release\activity-stream.discovery_stream.json.tmp

MD5 52aa3255207d3898eea7be3f79053604
SHA1 b394b839aebb13c5c4b81a23510d56ae691fc893
SHA256 fbfd5a4a21c0ee75fbce35360693f2b34b286e253df22711c0c7d71f3e114123
SHA512 8dc7a0a7a379de4ef9338e419d945fb5e9cbc8f3d3b48f386cdf56bee98eea08bb370d156acccef493537506d0b8eb291d5e75aa596505ccf04b4f849f0dd023

memory/1292-1460-0x0000000074BA0000-0x000000007514B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g1epp91b.default-release\sessionstore.jsonlz4

MD5 6102d26b3183cce6fcf357c42d412cca
SHA1 c56f8963dd91fe09e1522e7e6ccae897f1761472
SHA256 633060c9b21a7c92702926e700344f8fe9b573fed948e005f80dc27dd2f21e5b
SHA512 adb43ba983a826724839866ba1135409238e2e5f72e055c45c198bbe0950de6fdcfa7ed16e50b8299dde449b17344dc11417191a2b70c3b36683a6eb0c9525c2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g1epp91b.default-release\prefs-1.js

MD5 ee502456128988f688c42bd338912b14
SHA1 b3c3c017c9c048f8bde80c67fcaeeaf4a196246e
SHA256 e75c8c6d5fb056d61be164befa182c7c1dfc079ba53a013fdb16baa14225c839
SHA512 416f174c66cb81fe1ca100fc2c47c3906209e74b9d6991a33b87ce3defb6288900b8dc1c5115bcd4ee39a4ea1ff13dee97ae276f01fcdfcfcbe1ec7d1a1fc879