Analysis

  • max time kernel
    143s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    27-07-2024 21:05

General

  • Target

    Client.exe

  • Size

    5.0MB

  • MD5

    6663483929f325b3fe2f8a351787aebf

  • SHA1

    eaef70212f2f361a3167340d7c76e07246f1e427

  • SHA256

    cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

  • SHA512

    12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

  • SSDEEP

    3072:iEQ5B9LypBTl57/zzTx+feymDt9SYzOP+:iupBvLzTIf4Df7zOP+

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.eu.ngrok.io:8848

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2792
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5z3rdjgd.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DDF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8DDE.tmp"
          4⤵
            PID:876
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\afxe9xzm.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F07.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8F06.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2832
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\37in9maw.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES906E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc906D.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2124
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8qhfn6si.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9232.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9231.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1800
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bmv5sdgr.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2344
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES932C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc932B.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2116
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\adkdf12j.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2984
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9454.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9453.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3036
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xhdvnbaf.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1924
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9609.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc95F9.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:944
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eji4f_4f.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:968
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9760.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc975F.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1124
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kkuhkk-v.cmdline"
          3⤵
            PID:2100
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98B8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc98B7.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2032
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v89bsdes.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:620
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A6C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A3D.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2288
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-ctrdgls.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:684
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BC4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9BC3.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1732
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zl_6fcrp.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2412
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D59.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D58.tmp"
              4⤵
                PID:1744
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yjneypjm.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2676
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9ED0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9ECF.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2860
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w7js2-mz.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1408
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FD9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9FD8.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1348
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_jrawm-q.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2592
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA14F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA14E.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2624
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\twr3hdx8.cmdline"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2736
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2A6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA296.tmp"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1508
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6jtkvwxz.cmdline"
              3⤵
                PID:2812
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA41D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA41C.tmp"
                  4⤵
                    PID:1916
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-itskbso.cmdline"
                  3⤵
                    PID:1692
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA526.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA525.tmp"
                      4⤵
                        PID:2056
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u99bhkxz.cmdline"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2824
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7A6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA795.tmp"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2844
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oo9ekpnx.cmdline"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2816
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA8AF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA8AE.tmp"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1400
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmw4nmgy.cmdline"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2964
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA989.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA988.tmp"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2444
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9ic04u5t.cmdline"
                      3⤵
                        PID:1052
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAB2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAA91.tmp"
                          4⤵
                            PID:2380
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\noid8s_e.cmdline"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2376
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABDA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcABC9.tmp"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2652
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tio8we8n.cmdline"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1056
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD50.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAD4F.tmp"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:3068
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jhgl6pvk.cmdline"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3060
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE88.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAE87.tmp"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:1864
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nkoeq1ar.cmdline"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2420
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB02E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB02D.tmp"
                            4⤵
                              PID:2944
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1964
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                              4⤵
                              • Drops startup file
                              • Adds Run key to start application
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2092
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:576
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s9bmyvxp.cmdline"
                                5⤵
                                • Drops startup file
                                • System Location Discovery: System Language Discovery
                                PID:1564
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FDF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3FDE.tmp"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2760
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /sc minute /mo 1 /tn "Client" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                • Scheduled Task/Job: Scheduled Task
                                PID:2696
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dgf8hds9.cmdline"
                                5⤵
                                  PID:2880
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4136.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4135.tmp"
                                    6⤵
                                      PID:2864
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6fjd7_so.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2620
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES425E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc425D.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2644
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eytb3uxi.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2388
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4319.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4318.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3048
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hr3ba3xv.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2436
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44AF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44AE.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2812
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\myx8xs-h.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2432
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES45E7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45E6.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:648
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n_92kyl1.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2636
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES476D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc476C.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2936
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jcl9xzm6.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2036
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4941.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4930.tmp"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2372
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m1zow24v.cmdline"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:536
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A4A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A49.tmp"
                                      6⤵
                                        PID:604
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yf5cs5f5.cmdline"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2176
                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B73.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B72.tmp"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1164
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s3uxjngo.cmdline"
                                      5⤵
                                        PID:2148
                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CDA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4CD9.tmp"
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1820
                              • C:\Windows\system32\taskeng.exe
                                taskeng.exe {54162E4D-6B1C-4004-96FE-8E34393FA2D4} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]
                                1⤵
                                  PID:1960

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Index\vcredist2010_x64.log-MSI_vc_red.msi.ico

                                  Filesize

                                  4KB

                                  MD5

                                  c398ae0c9782f218c0068cd155cb676c

                                  SHA1

                                  7c5bb00a34d55518a401cd3c60c8821ed58eb433

                                  SHA256

                                  9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3

                                  SHA512

                                  85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

                                • C:\ProgramData\Index\vcredist2010_x64.log.ico

                                  Filesize

                                  4KB

                                  MD5

                                  cef770e695edef796b197ce9b5842167

                                  SHA1

                                  b0ef9613270fe46cd789134c332b622e1fbf505b

                                  SHA256

                                  a14f7534dcd9eac876831c5c1416cee3ab0f9027cf20185c1c9965df91dea063

                                  SHA512

                                  95c7392ffcf91eaa02c41c70a577f9f66aff4e6a83e4d0c80dbd3a2725f89f90de7ab6484497bf6e0a0802fd8ced042647b67c5ea4bee09e1b2be30b0db1f12f

                                • C:\Users\Admin\AppData\Local\Temp\-ctrdgls.0.vb

                                  Filesize

                                  370B

                                  MD5

                                  31fc52bfcb5cf9a12d52b79c7dceaf11

                                  SHA1

                                  ec19379305a8404d3c86adb65782467d1c9c3b38

                                  SHA256

                                  2b2c31fe62190c52b62ece3e29a19af2309832922d627abd7b2900eab548c19e

                                  SHA512

                                  38679030edebf6272eb04b0ef9b0b432eef26b23e7c6a517518db3a15ba40bd33eba33835a5cafba2a9fbe73c90ba964cb6bcf375ae6a84dc75693008a8da627

                                • C:\Users\Admin\AppData\Local\Temp\-ctrdgls.cmdline

                                  Filesize

                                  263B

                                  MD5

                                  ed07f3108db15914095bd3e4ad13c131

                                  SHA1

                                  f0c12626b19b753db41304e12a6da18090028f39

                                  SHA256

                                  fb9d4defb4acaa7ac0eb69efd734e97ea174eebb0b02f62b4a10e52a773fb461

                                  SHA512

                                  4eb38c3f00c0ae2c0fc2eec9df1f2c2817b1621fc9231d3ee7a5b6b03739ad8354723d7c6eb7c8823e428a2ac8b1a0cb3e0011082896d673c2362720732c79fe

                                • C:\Users\Admin\AppData\Local\Temp\37in9maw.0.vb

                                  Filesize

                                  364B

                                  MD5

                                  a44396dac48f30ef8c8608531567fb83

                                  SHA1

                                  905391559e0577fbc6cefd0d13eb10f9dbcd63c3

                                  SHA256

                                  1ba098682cded71da604d1c99018e43622cf0bd8a609c0c6e2752e9ff1944b4f

                                  SHA512

                                  168ef2aa0bcc07f4e1a1f6652c8d459cd6c3c31ee579702e06977733da856419c9ebd1f2da06fdd185655dc464cd40183ddb32cfe0e960bc6104c64fdc9976fc

                                • C:\Users\Admin\AppData\Local\Temp\37in9maw.cmdline

                                  Filesize

                                  251B

                                  MD5

                                  c51481ac8066a7aa5f7df30be9f00314

                                  SHA1

                                  3f0e07afa5d29af7f7555c571805210dcbcc9671

                                  SHA256

                                  32d4abbf18b32b343151c5ce6ec4cfa699188ee5c8660ef85287342ac342def0

                                  SHA512

                                  9069b132bcf59b2ba47503a123f65990336bb3d7b9c40ae084e7f4ed1446f57605cd345223f0cd7c695ae7235cd914546aae88cd2b50ef351063c5e27e28783a

                                • C:\Users\Admin\AppData\Local\Temp\5z3rdjgd.0.vb

                                  Filesize

                                  364B

                                  MD5

                                  3c88d0389da097789f854d19e5a6851c

                                  SHA1

                                  9e0f6bb3a576bb0eaf7fa1384018e57b50401adf

                                  SHA256

                                  b0c7beac256055e2a91713ef20ab4bc9eb5785e2a7cd30f64ab95fe37ff4d60c

                                  SHA512

                                  92799b8e42dd602cb9686820bc75136e26f2f356a731c23e3a3c5d9f65ff0b2325666aebd1f34f4ebf240eb047a11e9a37751f3fa3e30264738e6c113f8d9ead

                                • C:\Users\Admin\AppData\Local\Temp\5z3rdjgd.cmdline

                                  Filesize

                                  251B

                                  MD5

                                  2537ab5c3fc3b2a0a042471d0680f9cf

                                  SHA1

                                  1a3ce843256277d082af5c7059492b204fd07cfa

                                  SHA256

                                  97899e859ab0018b3a38933675c5df69ef5571d31c06a4f5512ce6e078eb5f17

                                  SHA512

                                  f7b078b4ca0e043653701f36888a62bedc30368efa6d5551612caf405bf8b8d0f16a33e30a4125f98856ed5ef496328b26693211f1d0f5c0fc59b32baff3a907

                                • C:\Users\Admin\AppData\Local\Temp\8qhfn6si.0.vb

                                  Filesize

                                  350B

                                  MD5

                                  55baa1a9cc195fdeb239fd42886466ed

                                  SHA1

                                  21d56bd00b7bdefb6fd1f2735f2249cde0812132

                                  SHA256

                                  483fae1036126f05605dff2447307d8e840ff775f5cf7574fb5b0256beb95766

                                  SHA512

                                  8dc014a020e6ecda766b1f58928b1d10a20c5ea2e3973e94d8c339ea772044e3898004b753b9ff4020b436c543206f4ab46468b789d08466136baf0812e81daf

                                • C:\Users\Admin\AppData\Local\Temp\8qhfn6si.cmdline

                                  Filesize

                                  222B

                                  MD5

                                  cd8d1876e38bebddd1ed55a9b6a5bdee

                                  SHA1

                                  df96835219a79b5406a9529e4a4b54da03f226d7

                                  SHA256

                                  6c6016ceddb2a3d3b4717a70af3d659b4c2e0b3e40dd112c13a87d596d6cbc65

                                  SHA512

                                  88550f508b28a23ac4304da2c92ac4b0e8c4a071dbe9ff1cdc9487127807cfded41dd7ec102eb0647a1d465bfce415ddaa41473b2f945a3daad891ba91f7bd5d

                                • C:\Users\Admin\AppData\Local\Temp\RES8DDF.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  3139e880d751e2a754aa4ec1bb03ee29

                                  SHA1

                                  0dbdca3922864f78b303fc55bcb1b318524c6796

                                  SHA256

                                  1abe82a42fd53f24e79945aedb88442f7d6b7ad9f618dddc4747cbbbcf9c824c

                                  SHA512

                                  c594084b812c719a78e2eb21c7638e84d8546874ebced3dc0d6c088d759be28c730f7b8813a938920385aed8adcff7d756f108be810dbb8776bbb488e64affd7

                                • C:\Users\Admin\AppData\Local\Temp\RES8F07.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  88ef457da2f098863cff35438d31a832

                                  SHA1

                                  cc3459dcf80faf62ebc66b5218d82382a22bd0c2

                                  SHA256

                                  6874d1dc42ecd72d0b65235d7d0084132fa71c73756a6a3444355441cecf19d2

                                  SHA512

                                  9cfb5f71c7ca74d87afe5dfd8d764601063d881353132309a29bf61c055754fa8c75e613c7ce101ad92c5b2069ef49648add686fe90763149a672812d4dafdda

                                • C:\Users\Admin\AppData\Local\Temp\RES906E.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  5e2b59906751ab63bed438f754815d79

                                  SHA1

                                  cfd3ca4f200339a11395d02d8dcadbe364e789fc

                                  SHA256

                                  bc598cf4acfcac85488c49ac7c0892891f002808587158d4072ef97fd5768eb5

                                  SHA512

                                  8804f75ee7febd323b6782909e1b6090ed944110bbde1cade622b472bbaebf7752a900233fa04a78537e1a2f5a47a905d4271ebf338b060130cbc8b6b0cee805

                                • C:\Users\Admin\AppData\Local\Temp\RES9232.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  44c4f56d63806a203d3b11c4b06b4dc1

                                  SHA1

                                  c88927a8f371dcd75e3e91becb5b0b26f7ac81de

                                  SHA256

                                  3710833f0433a3dafd6b771f4ac50f82a4a0cdf8871ec38834ea7e21ebad5e80

                                  SHA512

                                  744f7ff496a15dbcc6f6711afec6e5a281a3a9b05ad3e43d84a0796478b706982665a2becfcbe99930f9c4881a0e2d0808084a3cfe72643f2ee2c20fbc641ec9

                                • C:\Users\Admin\AppData\Local\Temp\RES932C.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  5d7869b16b908bc6eaaafe9a7642951d

                                  SHA1

                                  a115a952baf506b5545e02fde9084d6b4b89b569

                                  SHA256

                                  6cc11fef09d5a79b803fd2240ee951f5536c206d4a344bd639bac93dda4e6056

                                  SHA512

                                  d093db8e9166834b39e679848c68a925c265a9ad8e7d05fb2465a5a46acf3386f9f1a99fbf69959465cb80d868531b0ee2eea7b1696ad00346be1cf75c352b09

                                • C:\Users\Admin\AppData\Local\Temp\RES9454.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  9f6c0ea244d11de0991d09f9fcee777c

                                  SHA1

                                  637bacd450ed8f94589fee65ed2a2da958bc5cec

                                  SHA256

                                  89603381509be84a3e3d9585543f73c98b70d1527b93cf8f06109cd077c34573

                                  SHA512

                                  d28af3be34e2aeff7a9d5631800fcb4c29cff1ee9e429fab9f7b7634677de122501dfdafd913e16468bc8517b8111dc2cbd8d948486c896711af2777a7ba52ab

                                • C:\Users\Admin\AppData\Local\Temp\RES9609.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  9bea4f999e5567bc447bca904c203066

                                  SHA1

                                  b164cac2a83b73220ad950e59547f626d4555066

                                  SHA256

                                  b43dcb0abb2306e568f012646114da1744b35831270b45738655b9748262521b

                                  SHA512

                                  0e880b0993a5112c6ea28dba0cc2c4139cddf9441b3be0dcfaa9cb7ff886fc54ed7f098a8ae3f984712243d85f6273033f19fff1abae3b273c3166a09e357eb0

                                • C:\Users\Admin\AppData\Local\Temp\RES9760.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  dcb21afd2a5647036b8a50b1f2958f00

                                  SHA1

                                  251facfe9cd714fb0c1a1fcbc12bb21a4138d7b5

                                  SHA256

                                  a351b7776083dc746bc762be8cba8609f72a216cb9cdb53acbdb2092a6d5d7fa

                                  SHA512

                                  570352e351179c579d48414565f6c0121e42ddd2804c73e79280b550dc6154fc042db1202a39ed31cea8014700061fafdc4f0b9cb0c4f9c9266b812c59deecd9

                                • C:\Users\Admin\AppData\Local\Temp\RES98B8.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  3b65a6b47a1e8c87be3a7419d8884bcf

                                  SHA1

                                  53780de1db837839decf4c40c3bc1944a46a1521

                                  SHA256

                                  f5dac1fcb189f114c7d3c3a17edc205425500a5aad7e0f1ce8b1b79519086a22

                                  SHA512

                                  86811d4a14e32abbe00d0c2e434cb82450490537084502e35219fdbe3e4302c89a9ea442850201d5a27e01d3c888646eaade8a90fba2ac447370b62d25756f7a

                                • C:\Users\Admin\AppData\Local\Temp\RES9A6C.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  02720e8fb0a123a23f436911402a7d0c

                                  SHA1

                                  b16be9e0282ca0f4e4b2c5090fbb3c9eb318f86b

                                  SHA256

                                  696547891270c53126ff3968169d60dfb0044734af72cdb4ba38eb6e79b04cf3

                                  SHA512

                                  63a6f127023c22bbe35eaeeea9a95a38c9be4cd0d853b54643f9b5a8a8a682aea642646303f0ae7b1ce0316a3fb4cb27d158c883bb4a2e0d82cbc5f43b98c790

                                • C:\Users\Admin\AppData\Local\Temp\RES9BC4.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  ab871eca371a3c541e9fb3cb9f73a018

                                  SHA1

                                  827510382cc527048c95d28d3c59ce98c4df622e

                                  SHA256

                                  87bf07a00ecd19663fa1bf336172588634e8a4d904c0b42acd7518e9e6ddd2cd

                                  SHA512

                                  12df658b22bdae532b75637158c02b5701e7d453368b7e972f4ce81d84fa05594abb438f9f1b9f853acfb66c13a7b93c6efb5fdd21f368b1c6cf7c92910c282c

                                • C:\Users\Admin\AppData\Local\Temp\RES9D59.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  0a38fb8501f2ce56b16a72691a6d1a19

                                  SHA1

                                  9cfda27a4ec919df168b568a965636d69429ad5f

                                  SHA256

                                  94047f0ae46b85cf0af6495ef953b66dc565a60473a6e56e1e970700ea996a0c

                                  SHA512

                                  d90e55ad07d2ac1a0d05ab4bb19294030b115456139012c6ddf647b5862b6550bcfaf92974d22d1242969faa0e38f2f3cf30cc79d2cd568a19b584b7fb38bcdc

                                • C:\Users\Admin\AppData\Local\Temp\adkdf12j.0.vb

                                  Filesize

                                  368B

                                  MD5

                                  4a447b73c91023eb6c863a34742dbfdd

                                  SHA1

                                  68fbb85cab50aaeaa9abedff254efba01892310a

                                  SHA256

                                  b9d69dba98cd1d12c4a0ed06def7734936270924cb3847807f6f04f3d0fac242

                                  SHA512

                                  dfc531d34abadc872b5db88a087784181970d8cb5b958fe979e431dd2bd135c6699c738a61e26e7fd9674af90449fbcbf810b42e765b0add5d9d66ad6e83299d

                                • C:\Users\Admin\AppData\Local\Temp\adkdf12j.cmdline

                                  Filesize

                                  259B

                                  MD5

                                  c846d6918d57b2f4a85d01449256a1b2

                                  SHA1

                                  03a8ed60423ea2ea7623ec65f66e6e692f2bf4b9

                                  SHA256

                                  0948f1b32e5eb3c51f36e04d56a9ed2338d8b687908831e2a296d1092a016651

                                  SHA512

                                  9f3720fd63c697289b02d284cf755f6f7296d328ef2e9d171a43f6a13967631b6f823f8d8e1750d9b8500acc5c4cc4269662e3e55e6d2e987a20f80a12369504

                                • C:\Users\Admin\AppData\Local\Temp\afxe9xzm.0.vb

                                  Filesize

                                  350B

                                  MD5

                                  3fa7c020766873f8b58d109177c7d7a1

                                  SHA1

                                  716be689ba29ba1493a617920c24fa6ef036ed5d

                                  SHA256

                                  dfcfb090d3b80c08c34aa55028773778a8a745c2eef48d8c572b043fb421e3e7

                                  SHA512

                                  1657d79d5bd7768984df780f71e9609c69fa58c7370eb5ee8122c97daf1a2c47fb0217f3f69e07f8fd0c51c8f8e078a00f8275eed3bbb02ec23ba092c47ec196

                                • C:\Users\Admin\AppData\Local\Temp\afxe9xzm.cmdline

                                  Filesize

                                  222B

                                  MD5

                                  ce20329fe82bfc804042850316a5a2c2

                                  SHA1

                                  d749110d35278752a0a96d76de025e9db331b01c

                                  SHA256

                                  6e11355a2021c8445f0deae783bdc6ff30c3c90f50683aa310e56a80fb50d28b

                                  SHA512

                                  ce16eecfde2316850029df40d5867c3e15a1956ea4a055c10f3eb409a36ab311e28e92db95116e17822ffdd62c008a9f763cc3002e6ecab12763fd8a7cb8924b

                                • C:\Users\Admin\AppData\Local\Temp\bmv5sdgr.0.vb

                                  Filesize

                                  345B

                                  MD5

                                  78fa359ee91a0ac0453b7fa92df75649

                                  SHA1

                                  bab1cff88be95b883b900d06be9242e93fd25f94

                                  SHA256

                                  37d2c292818dbc06626bd9fd12eb14a33ef65f82356cc9345ee449ba62fd4a52

                                  SHA512

                                  d6c2fa6abadd2588355225403713905d02ff19365bbf1e415df1bdd4aceeab35ba29767d09b072c513bb23a10779a5198cd6550ff9ab3e0e58bfccc9b2c5726e

                                • C:\Users\Admin\AppData\Local\Temp\bmv5sdgr.cmdline

                                  Filesize

                                  213B

                                  MD5

                                  db6a7a9ef7d6ab5d78512eacc0501d15

                                  SHA1

                                  82a87e89997aa33cb3c11d2a6a844551d01e4e2f

                                  SHA256

                                  7babcd725b9b33ac4aa1b311df2838ef2dceb0cf4bdc8e099bd81b652a23eb9a

                                  SHA512

                                  15436ace78f1f60b12ad2cfde53ca9fb3151fc7814411dded5969b54a0d05066bcb537e0db38bc9b27d41fc26d324c04dc6f92472a71ef8d8a269f53f1938538

                                • C:\Users\Admin\AppData\Local\Temp\eji4f_4f.0.vb

                                  Filesize

                                  345B

                                  MD5

                                  df1975c930424e8628631c7d62ec352e

                                  SHA1

                                  4af9901ee310e4af180378c50eeb28d4c4e1f9a8

                                  SHA256

                                  0c4b24af1f47981d06c889d02d24f1047b9e8388945ad2a1b079166acbb40c2c

                                  SHA512

                                  d58bc77ed44d68f60b2b9f158c53b31cd47bdae16a555bea9a437bdec2bc3c7ec3b5a500eab7aa4c9a3eea546c93e99f3786f62dba37f86db0b8d20c67c083e9

                                • C:\Users\Admin\AppData\Local\Temp\eji4f_4f.cmdline

                                  Filesize

                                  213B

                                  MD5

                                  364aaac89894814eab0adb034884361c

                                  SHA1

                                  79c9da7505fd15e520525d74f7554a9f2659d1bd

                                  SHA256

                                  9587c6d1b3ccf860ffcd8b1f8a81d1a13770f1cd5f9a9421c72e8bb6a751c327

                                  SHA512

                                  942faffc9f356e4d7bbe15eb76333e1e9a7145c26eb0d5b569e3e4a44b57ca4c5f9b991b13931a8c1f40f7a1047f73e08bf73fda27e5807e1202935a0ed2ce2f

                                • C:\Users\Admin\AppData\Local\Temp\kkuhkk-v.0.vb

                                  Filesize

                                  368B

                                  MD5

                                  847182193015fc5d88f0c98c81c630ee

                                  SHA1

                                  7811018c8b8e5d6d01fb62972a426541635f7cf4

                                  SHA256

                                  08ebdceaef531c894727e6332a804ff5bead32831c6744ea1b52b22d420060a2

                                  SHA512

                                  1de1f111195e1f8d492c8ecd884d04fbb3b39f4781849c2d4d56085555844f34c2b6f6af15ea7a234fb6ed3b21f08deb19fc0238fd57f58df2b0cf1c59d0047c

                                • C:\Users\Admin\AppData\Local\Temp\kkuhkk-v.cmdline

                                  Filesize

                                  259B

                                  MD5

                                  6ccbd71df86a8313694d61e220a71378

                                  SHA1

                                  e319f37215b497926df3927433442c8f671f0e18

                                  SHA256

                                  1b3cca5f1f4d7312ab2ed0b94aafd2a34a214a4820dafe339001dbfba6b851aa

                                  SHA512

                                  adaa42e3453aab5724714a94c525c6d5f7013308f4d1a947e86f031a10124c6482ec4b9a46934efe54c0de8e4996c402cf928c8322af91e06a11827b7fc00eb7

                                • C:\Users\Admin\AppData\Local\Temp\v89bsdes.0.vb

                                  Filesize

                                  371B

                                  MD5

                                  556472f96ba0a829d9cd7592411c2347

                                  SHA1

                                  a2fae1bb654469d975926c75b9635a169a80c76b

                                  SHA256

                                  6589cfed04466d3dc448361f54572309a731aa8d54aacf50aade28c0f9225679

                                  SHA512

                                  a938b6b875dd8be3e942cb4c9939f7718ef930d1feddba516070fc5a308065e8c7ebe7ebd606e3fcf61d25a06d9197b3285043f85dd7c69b072cd9daf90f414a

                                • C:\Users\Admin\AppData\Local\Temp\v89bsdes.cmdline

                                  Filesize

                                  265B

                                  MD5

                                  5a0e5d523b9a6288c96cdc4b1570f4db

                                  SHA1

                                  1e8a972441e98fa5d32dd21bdcbd3048451eab78

                                  SHA256

                                  d606e640b7b8cc63d0484057bf094df0abc9c249f1ae594a05421c84111173f9

                                  SHA512

                                  5521bd0b646a0bee04f94bb3acf553fae47db84049ea5289a8131b05af54cb742da5f1e01cdccf001d920817c9912939d3a4c303a7ce0630b4ce6bf6ebee9c7c

                                • C:\Users\Admin\AppData\Local\Temp\vbc45E6.tmp

                                  Filesize

                                  668B

                                  MD5

                                  3906bddee0286f09007add3cffcaa5d5

                                  SHA1

                                  0e7ec4da19db060ab3c90b19070d39699561aae2

                                  SHA256

                                  0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                                  SHA512

                                  0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                                • C:\Users\Admin\AppData\Local\Temp\vbc8DDE.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  6cefaf397ee40eb5c3df27193a26e399

                                  SHA1

                                  ab6097301a83d831b6b63acbaaec0285126f4ae5

                                  SHA256

                                  43a6fa373945bde88b7cc7a083aa81c18e959815f79c4b304afcded5230789df

                                  SHA512

                                  30f4fadab57fbcd25e58c842a98583dc607c52c6a21ef346f63d4035c2d34243a11ce572cd401e6958262509bf91b71e02f56236c69f3c1f606f5720210cb9de

                                • C:\Users\Admin\AppData\Local\Temp\vbc8F06.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  1925b323c24d5e44f273b65bdf58f85e

                                  SHA1

                                  704e92b27adad5266b25a84b66491065e6a8e077

                                  SHA256

                                  f1109f98dcf21ba90f165c3062b89f8f730850c75cbb1ced23b75c7ea1443f63

                                  SHA512

                                  c3c03be1d12b8c3dd33fa234d60d0328bfc0ea2bfad160d825d5ebf8ef1511f66cd85c9b0d419e83b2ced52fe99ef0df992fea35b2cb912b60ef5635ac25e969

                                • C:\Users\Admin\AppData\Local\Temp\vbc906D.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  2aa7b07c157877ad67f7d79b15da9ff6

                                  SHA1

                                  451dad641b7b329378d0238e1d0c9a27d47a3f40

                                  SHA256

                                  9f5688e5525be99764b3e610afa58af84e43191d524c99a196ffca8118e4f950

                                  SHA512

                                  5a358cd9b6003a867c5c94e3ee0ec49a8cf04c313995fb3999f7cd5fbfc6dc2fdf52da181054aeeb6b05025e603110bda1f2440bbeb2c848698da412c7a695d3

                                • C:\Users\Admin\AppData\Local\Temp\vbc9231.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  552cdad34f767fe9ceba407cfeaaa5f2

                                  SHA1

                                  95291c8d45589e53428a2895b17c8c0f9d398eb4

                                  SHA256

                                  69d9a6c71053bfda400ee50b358b31346621457181ba94ec8645f4df87f82f49

                                  SHA512

                                  b5e66fc5e7c782da773228e79872590354d39baadb57ae32b25d816d612d580056c8cb9b7a5dd07c0a82230e69f5672dd3329b04028ffec3e5a7c2a5ebea0ad0

                                • C:\Users\Admin\AppData\Local\Temp\vbc932B.tmp

                                  Filesize

                                  4KB

                                  MD5

                                  088c37d81dc5ad27664ac1097307b614

                                  SHA1

                                  b29acd60e4297267b798b78357fd6be2105fd395

                                  SHA256

                                  ba5b85970b94de08b3cf0d511d4e0df19b2452323a2402b2e103c7f619675b77

                                  SHA512

                                  454a72332f3cc8e2aff4a2257101006f5d5d40eb9441f83b944542dcc98b1e41120609d75f53fa3a269b92797cf2f607961dcf517d3b4a5290025ea8a0657715

                                • C:\Users\Admin\AppData\Local\Temp\vbc9453.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  3ccbd45c6b0f194811118d4b7323362a

                                  SHA1

                                  4e1376f6cf4d183f7b29496e1419f9fbb3f9786a

                                  SHA256

                                  77d234f1c365f565425c5af9873bdc915bd6a81d69fee1fad8ddf01217bb32ee

                                  SHA512

                                  ae3dbeea13020c3a68c53b0818a84973dea9d33e787675d0e2a42aa3988fe54e893a6eb113fe4bf7349ed7a9d2315adef1412d2f31f483df1dba65f1b5685968

                                • C:\Users\Admin\AppData\Local\Temp\vbc95F9.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  4367a7371c6b4a0684704d101371b319

                                  SHA1

                                  017269e6b19d459626d4809ebd7f0679ea69b0ec

                                  SHA256

                                  8ca899b5a49a42920615d57d571ed2f74c7513175d5a5fd3de81cc13ab87b1b0

                                  SHA512

                                  ea0dc5cfe5deb08cb192eee62ea9855a76317169d0bd0238a8707748e8c942f2ab14b182f6b3b65d1ea5905e5f1e62bbf33aef02cdf4476a97e871b19c05f225

                                • C:\Users\Admin\AppData\Local\Temp\vbc975F.tmp

                                  Filesize

                                  4KB

                                  MD5

                                  a6c43b263e6b425580e0e8e86dc235bd

                                  SHA1

                                  9e48907e177ec653a029dc2df455f1f042df7308

                                  SHA256

                                  050542468ce8ed1767cf42833f80e7d2eea0309c51be5cc331a1d6cd8f66d817

                                  SHA512

                                  6e152ee0d74de352ad9fc484eef32c50941cd9dc50ef41a8a379a36920d4d3f4933b4428849d764f66ec5924d211155d5a219f6aa57e229a4980cbef8fbafa40

                                • C:\Users\Admin\AppData\Local\Temp\vbc98B7.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  3843a53d7e2dbfa4c232bdeadd21c357

                                  SHA1

                                  3940e541bde859a4f090303c16731a24dca505fc

                                  SHA256

                                  0bb59ed84a49d712878598b06ad05f0c26f5f7a155509554ccf96c14ab6e29f9

                                  SHA512

                                  1d9ae65cd4f765e04c5ec1d717c15df13d4c92b32624e7a5772b4068ae3c74e8159e32552bbaa18cf34b656b788971e21b1d37801d3accc567bd7e2dfddaa111

                                • C:\Users\Admin\AppData\Local\Temp\vbc9A3D.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  3ea71f08d9ecaad5d91ef675c333e68d

                                  SHA1

                                  fc7b47ccdee042f88ce0b83188a65dbfe14403b5

                                  SHA256

                                  19b095eec85ee85b484bee4630f38f2a0966e289761fe2773be9f24ec67dd5cb

                                  SHA512

                                  99111f95e59e03cf379f49e63035b81f0402ad080c1a7ff21f4fff4aa3e1b8102a623e8ce02c75e8ac9c9884c558ce3ac9174e6fa680c57f92d47de3f143f4ec

                                • C:\Users\Admin\AppData\Local\Temp\vbc9BC3.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  e6c60ba9b4fd13ac52f6b57ead9650a0

                                  SHA1

                                  d21772c045803b49002066829c675c5be2e37dcc

                                  SHA256

                                  473f21d49c26b2a13798ba62741c565f0f32c25e49fc3b38244d303d01f946bc

                                  SHA512

                                  af86bf7105190630729f567362a93c34625b91af7844d6df27670beac7be6f948e462d88e3438a0ce467a62a8375eacdc455f13e201fc9db1dabe3cf413c1da7

                                • C:\Users\Admin\AppData\Local\Temp\vbc9D58.tmp

                                  Filesize

                                  5KB

                                  MD5

                                  3c6dff42b6144277ccd0f823e1792790

                                  SHA1

                                  261efd8b74fe00e4630f52b3273f412ded3428d6

                                  SHA256

                                  a6d25d650e3cc9ee7c407b971a9e5d3d02583e955d58422721dc9354d33fe47f

                                  SHA512

                                  7ee1aa029ba06c93f06cc8f99f569a18d53b8569fcc57c8aa170ed185a82ed5cf1ec9052b6060c5302a62a20ac8a54ec11b4479002d2bacff41cdacdcb4f87ba

                                • C:\Users\Admin\AppData\Local\Temp\vwfRtNH.txt

                                  Filesize

                                  44B

                                  MD5

                                  bfbee1ccbe6981fafb1c7bff99680882

                                  SHA1

                                  3866c915b8a7e0592f8728c89faf6bb4d5ecf002

                                  SHA256

                                  74976c31c2c46d066f3d9a70fc73b3a7dd541d5a889a6644a59f09b53960a235

                                  SHA512

                                  6bb98708f97b426a6ef445681a9169671d084f1a876e6ff07b8c595add8f996509d5e003a04b1d58ca10332285df2686bec4e6b470f6b3f8a19e15be256dbd2e

                                • C:\Users\Admin\AppData\Local\Temp\xhdvnbaf.0.vb

                                  Filesize

                                  371B

                                  MD5

                                  846365ec5052d6dabd406c35fb9393cd

                                  SHA1

                                  9abf408ca3938f0acbfc6eab9fccd33b4cfc43b0

                                  SHA256

                                  f1c039830bf9f701f465510cf16ae094214fcfc23a3c311adee9e6f4c18851b3

                                  SHA512

                                  cf3a29a98a1a53982bd6afbc8dc61b954c26138f9b85473b8a3297ca7ee3c3b782a3b6edde8b0dbbe406bd26e52d72c40a0c1d58dbdfb40c8f9e461bd6542b2d

                                • C:\Users\Admin\AppData\Local\Temp\xhdvnbaf.cmdline

                                  Filesize

                                  265B

                                  MD5

                                  34aa2b1a2fb0965959b620d7b8c6b0b9

                                  SHA1

                                  7f4e9b2f4713e4254f1181d2de31ecea761432a7

                                  SHA256

                                  abc1692fe522f238ff68df85d94392b60473e3aab9e5551db7ce10e88683b64b

                                  SHA512

                                  bf1a67ab55a961571568c6f1bf03906f64d6e4c2c586efee0d5d823c5578729b6efc485e15cd62692dad630ec64c4fb9baed9d06787248189f672ef93be19dc4

                                • C:\Users\Admin\AppData\Local\Temp\yjneypjm.0.vb

                                  Filesize

                                  370B

                                  MD5

                                  70829c1a9fba55df73e0bb03cc02dfba

                                  SHA1

                                  e0eb831dfee7c9daf3856af584d62c4cb202e852

                                  SHA256

                                  70274ebc993bc093082ff93802e33a7107df02aee8d392fe723459d31bba7fe0

                                  SHA512

                                  47eeac79275c292076c22348179543e3e3aa26c51c759d72c42362799437a761dc7707640b3634572b0c1e80b64fd82feae271ed45e06794976278a51252433a

                                • C:\Users\Admin\AppData\Local\Temp\yjneypjm.cmdline

                                  Filesize

                                  263B

                                  MD5

                                  58af5db8451f043caa1821de49b26bee

                                  SHA1

                                  b05384aae8b378f7fca495a57766e2d568c4926f

                                  SHA256

                                  721272c58c531ae8f7a752ff39cf7983313822dfe4881f79a14e9400e7ea0f7e

                                  SHA512

                                  67340a2be241dbd9adc83a826b8bce51c0e39a864d132139166e23b02002c9b67cb1179338dd79841336dba83d35f825590adc02d772c1e1abe3c38fca2adbbe

                                • C:\Users\Admin\AppData\Local\Temp\zl_6fcrp.0.vb

                                  Filesize

                                  373B

                                  MD5

                                  1d051ff4cd0a27121e93aeb23d1df6ef

                                  SHA1

                                  4c66c8113b537573b9e54193605009ef612d0ee9

                                  SHA256

                                  c052ad284c34c0af73d878521251ca7bad9a390e5e7e3b2422dc0f5ca86f4b82

                                  SHA512

                                  501b5eb718214634c3386ad9a6df7dd48d9a75d4ecbdc2217d1e785e04e725d899a173b06354b21abb16e976e98a1869792cfa1618069090005425bf9472bb38

                                • C:\Users\Admin\AppData\Local\Temp\zl_6fcrp.cmdline

                                  Filesize

                                  269B

                                  MD5

                                  0ef1adf842a5f61ef738fc465c9bee2d

                                  SHA1

                                  5127c0340835194f0cc0665ef1cc79ce72553682

                                  SHA256

                                  fed436899f1bf0c464c00d95b1960d0fc02548b5f081f4d25057361c77f8c040

                                  SHA512

                                  245484e535f249567081df89149de264161e0f915d7496b335c35468ff1c1057a91b9e22f3a44b1f04b0dd33b462fac4f8702bcd8d7ea01a6ef5c764b5000459

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe

                                  Filesize

                                  5.0MB

                                  MD5

                                  6663483929f325b3fe2f8a351787aebf

                                  SHA1

                                  eaef70212f2f361a3167340d7c76e07246f1e427

                                  SHA256

                                  cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

                                  SHA512

                                  12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

                                • memory/2660-11-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

                                  Filesize

                                  9.6MB

                                • memory/2660-1-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

                                  Filesize

                                  9.6MB

                                • memory/2660-16-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

                                  Filesize

                                  9.6MB

                                • memory/2660-0-0x000007FEF557E000-0x000007FEF557F000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2716-13-0x0000000000400000-0x0000000000422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2716-8-0x0000000000400000-0x0000000000422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2716-7-0x0000000000400000-0x0000000000422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2716-17-0x0000000073F81000-0x0000000073F82000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2716-18-0x0000000073F80000-0x000000007452B000-memory.dmp

                                  Filesize

                                  5.7MB

                                • memory/2716-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2716-19-0x0000000073F80000-0x000000007452B000-memory.dmp

                                  Filesize

                                  5.7MB

                                • memory/2716-5-0x0000000000400000-0x0000000000422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2716-39-0x0000000073F80000-0x000000007452B000-memory.dmp

                                  Filesize

                                  5.7MB

                                • memory/2716-10-0x0000000000400000-0x0000000000422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2716-394-0x0000000073F80000-0x000000007452B000-memory.dmp

                                  Filesize

                                  5.7MB

                                • memory/2716-3-0x0000000000400000-0x0000000000422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2716-392-0x000000006F940000-0x00000000701A4000-memory.dmp

                                  Filesize

                                  8.4MB

                                • memory/2716-15-0x0000000000400000-0x0000000000422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2716-389-0x00000000701B0000-0x00000000705BF000-memory.dmp

                                  Filesize

                                  4.1MB

                                • memory/2716-363-0x00000000705C0000-0x00000000709CB000-memory.dmp

                                  Filesize

                                  4.0MB

                                • memory/2792-20-0x0000000000400000-0x000000000040C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2792-35-0x0000000000400000-0x000000000040C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2792-36-0x0000000073F80000-0x000000007452B000-memory.dmp

                                  Filesize

                                  5.7MB

                                • memory/2792-37-0x0000000073F80000-0x000000007452B000-memory.dmp

                                  Filesize

                                  5.7MB

                                • memory/2792-38-0x0000000073F80000-0x000000007452B000-memory.dmp

                                  Filesize

                                  5.7MB

                                • memory/2792-33-0x0000000000400000-0x000000000040C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2792-22-0x0000000000400000-0x000000000040C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2792-24-0x0000000000400000-0x000000000040C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2792-26-0x0000000000400000-0x000000000040C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2792-30-0x0000000000400000-0x000000000040C000-memory.dmp

                                  Filesize

                                  48KB