Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2024 21:05

General

  • Target

    Client.exe

  • Size

    5.0MB

  • MD5

    6663483929f325b3fe2f8a351787aebf

  • SHA1

    eaef70212f2f361a3167340d7c76e07246f1e427

  • SHA256

    cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

  • SHA512

    12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

  • SSDEEP

    3072:iEQ5B9LypBTl57/zzTx+feymDt9SYzOP+:iupBvLzTIf4Df7zOP+

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.eu.ngrok.io:8848

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4208
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tx_3nxxj.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4DB7E5BDE8704F16AC2FC1D849A5782.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4172
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2j1alvdm.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AC2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc121F6A6089EB49019935FCE756FB50CC.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2356
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rfvkhhoj.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C97.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2A457A0252A6466998BCFB2BE02A551F.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2024
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x_2e2kwe.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:404
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F27.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA79B9A91A9D48CEAE9B39D72AA4786.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1788
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9k9agqvu.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES414A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D4D484C489144E0B057D89C9B731D2E.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3388
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r3k6k4ha.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES436D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBFDE3D297174448EAA5A9A701F1D96F5.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4260
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ubqc4dw4.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4541.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF3B6C75C95CA45CE93283B50D0578F23.TMP"
          4⤵
            PID:1068
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o_np6yby.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1492
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4735.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc259F23E86514A02A91B16569D98B669.TMP"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4228
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y4hqktk5.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1712
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49F5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDDA26D2097AE4282898862ADBD54C74.TMP"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1572
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cggrkb4g.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3620
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C17.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC93E9BE37A814A21AE35A026723F9D5B.TMP"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4788
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sxcjwx11.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4292
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E4A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc798D2D55C7124A8EA3882376473DC7FF.TMP"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1576
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w5nmb5cg.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4364
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FD1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D0FE588AB744C40A9B47C4984D593F.TMP"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3524
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2-bwft4o.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4488
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5196.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE2AA81C6B6A64D79ABCCDAE08B6274CB.TMP"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4444
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dovcpapm.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1608
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES535B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F6FF0B1FC5946EEABBC1DB0975FAC5C.TMP"
            4⤵
              PID:4432
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\stxhojmp.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3660
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5501.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD71AD89BB92403BBF867C54CC9573.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1748
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x6fjfmh9.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2812
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5781.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC7AE2D1EE78A4C7C938B6092861136AA.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2504
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qfz39_jw.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1064
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A60.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc486FC0DAFF34240BD9E9EBB7FDE779D.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5072
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dfdwlrpg.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2276
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C92.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC7159722BDA94D958BAA64D222D77B.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2692
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ejvol3ao.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:756
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E86.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc66853ECBD34432B92283250182D9294.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3640
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4uhsw-p1.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2112
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60B9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7357455B3D8341EAB6728C22E620F61F.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2472
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\orpoe0l9.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4188
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63F5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFBC97853E1E040A3AF7CB325417B58AA.TMP"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1660
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:4284
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
              4⤵
              • Drops startup file
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:116
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1768
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zbv48tvd.cmdline"
                5⤵
                • Drops startup file
                • System Location Discovery: System Language Discovery
                PID:3508
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA68.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1F0F5DB3DB1D41A2B1462E5197A95D3A.TMP"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4324
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "Client" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:628
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x16d6uzc.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1464
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDB4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc40A9B00E8770497E9ABB3DDC2A40B772.TMP"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2180
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9yvbpqkc.cmdline"
                5⤵
                  PID:3640
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFB8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF1B4D572B6A44AAB0874DF6B2E34.TMP"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:876
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oh9atfdr.cmdline"
                  5⤵
                    PID:4816
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES219.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFA81D7386BA24347B7756CCE299CBDB1.TMP"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1016
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mj5ap8gl.cmdline"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1668
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc87AD159ADF9346F3831EF55DF1729FA.TMP"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:4188
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ajbymlts.cmdline"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1944
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES601.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc25DEC36FCFF443AB8C51DA8A7DE44891.TMP"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3672
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kdr0-eyp.cmdline"
                    5⤵
                      PID:2356
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES882.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc639D73C8F6874F39A766A28F3FDBD9DD.TMP"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:4092
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nsr1q2gc.cmdline"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3368
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA28.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1DAC37A2D69D406083C9F55B751F312A.TMP"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:4860
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g-bwmhux.cmdline"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1168
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43F3992CC78A4991A2F0AA53296B21CF.TMP"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:4708
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fdaxkxx6.cmdline"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4352
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc80797381E0694765B1B870672D58ACA.TMP"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:4388
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9b7z0qbw.cmdline"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1824
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc763B3E1A5A2A4F7BB2E3DB253C0814F.TMP"
                        6⤵
                          PID:892
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ilcspff6.cmdline"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1484
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:5004
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                  2⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2764
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3372

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\Index\vcredist2010_x64.log-MSI_vc_red.msi.ico

                Filesize

                4KB

                MD5

                fde1b01ca49aa70922404cdfcf32a643

                SHA1

                b0a2002c39a37a0ccaf219d42f1075471fd8b481

                SHA256

                741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

                SHA512

                b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

              • C:\ProgramData\Index\vcredist2010_x64.log.ico

                Filesize

                4KB

                MD5

                bb4ff6746434c51de221387a31a00910

                SHA1

                43e764b72dc8de4f65d8cf15164fc7868aa76998

                SHA256

                546c4eeccca3320558d30eac5dc3d4726846bdc54af33aa63ac8f3e6fc128506

                SHA512

                1e4c405eca8d1b02147271095545434697d3d672310b4ea2ecca8715eaa9689be3f25c3d4898e7a4b42c413f258eda729a70f5ad8bc314a742082b5a6a8e9ff1

              • C:\Users\Admin\AppData\Local\Temp\2-bwft4o.0.vb

                Filesize

                370B

                MD5

                f1f4b97a4a7ccacf00d680ed41092d6b

                SHA1

                f8b32a0d52cb9a1f1d87752f9f3883c56eee16aa

                SHA256

                4050ab47352c7d9e885aec0f16054cfab523d854b4f4956027b82277379e1e80

                SHA512

                2b3ba9c1250e5c56267a99e79c155927c3b353734c485b31b0537c50a3cde35ca0d75a5bb8e1d230be8a3685dfe41bf3238263d03566ec6889bec6ffb233d210

              • C:\Users\Admin\AppData\Local\Temp\2-bwft4o.cmdline

                Filesize

                263B

                MD5

                6a35bc39895faf0a5f5aaca805bcdc23

                SHA1

                c319d97d86de228cc37462e75c86b2a1169d830a

                SHA256

                fe6137f1adbe69b58154df9bc4216e8831e8f7be067f2a546ea629b466fbaf18

                SHA512

                96a71f4579610aeb409b2f04bb994046279415b1c220821344abfea1a61d4cc441066f7d6b24481a3e9e1958f648a043a9a6f08aab48e755e279d6b5eb84efad

              • C:\Users\Admin\AppData\Local\Temp\2j1alvdm.0.vb

                Filesize

                350B

                MD5

                3fa7c020766873f8b58d109177c7d7a1

                SHA1

                716be689ba29ba1493a617920c24fa6ef036ed5d

                SHA256

                dfcfb090d3b80c08c34aa55028773778a8a745c2eef48d8c572b043fb421e3e7

                SHA512

                1657d79d5bd7768984df780f71e9609c69fa58c7370eb5ee8122c97daf1a2c47fb0217f3f69e07f8fd0c51c8f8e078a00f8275eed3bbb02ec23ba092c47ec196

              • C:\Users\Admin\AppData\Local\Temp\2j1alvdm.cmdline

                Filesize

                222B

                MD5

                5f1dfc3f9ea661299c366d4e0978482f

                SHA1

                792862c333614814b2c42aef21744fc0f715b03f

                SHA256

                284bb2f04d599a4de4bb7be1747e4049a3cd0edd98f32bfbfa2858a39a5cf7ba

                SHA512

                ccfab972a9f22c562b3560c9c99f828f8377a79f52e732d7ce7fe074129ce35dd36a81e164fecf881237c869c36b8ddc7a9ba79442801175e6565c45570753a1

              • C:\Users\Admin\AppData\Local\Temp\9k9agqvu.0.vb

                Filesize

                368B

                MD5

                4a447b73c91023eb6c863a34742dbfdd

                SHA1

                68fbb85cab50aaeaa9abedff254efba01892310a

                SHA256

                b9d69dba98cd1d12c4a0ed06def7734936270924cb3847807f6f04f3d0fac242

                SHA512

                dfc531d34abadc872b5db88a087784181970d8cb5b958fe979e431dd2bd135c6699c738a61e26e7fd9674af90449fbcbf810b42e765b0add5d9d66ad6e83299d

              • C:\Users\Admin\AppData\Local\Temp\9k9agqvu.cmdline

                Filesize

                259B

                MD5

                09eb5ef2eeca8fad63365b75d27e36bb

                SHA1

                82d556e9fbc65d06df5f2993f7c3e149e243355d

                SHA256

                ed81af878728f46ab5305362f96ee76829f10ce0f411f29ffe207b0fbe08b94d

                SHA512

                179beb4873bccac003de446ddbda1e57af095695c925cab552b2ef66da6d63a7ee76daa041223726f1d36e3a89d7457a3ffd0f07cdc278896a750b4b84aa7faf

              • C:\Users\Admin\AppData\Local\Temp\RES38BE.tmp

                Filesize

                5KB

                MD5

                2fe53c1f1a540134860b160615918dee

                SHA1

                0da71fde356459ec7e17cbb77666772d733b4019

                SHA256

                197ede4018f2253026f373a118df0247d4f1dad1d5cc16e987c5f390b8204ce1

                SHA512

                2d520c64aab2375acce1894af788e0edc4d3030ddecc51daad4c25774415501357f6bc5da2b9f3e27b7a5ba0f9edee2f595d535fd15f9d026b2c8d227526d46a

              • C:\Users\Admin\AppData\Local\Temp\RES3AC2.tmp

                Filesize

                5KB

                MD5

                a7bc65d26c1cb64fe32eeabcda455a30

                SHA1

                3674949e41ee5c8e181255b03870be6a979809c7

                SHA256

                02c2b02ab60253196f5f358aecf403a770bc4f7da936cc22785b05359b477033

                SHA512

                a0733b00675e8266cb4a279218f469aba7b4c1939efda97873b63a9ee619fd29ea69f18881d833dfcaa31c139ca3c136500b14618f0a658edcd905af1c0a33ca

              • C:\Users\Admin\AppData\Local\Temp\RES3C97.tmp

                Filesize

                5KB

                MD5

                0a7c4420522f3f3219b96e2690323319

                SHA1

                5311be6b1c362490fd13cf4bf712404e4b7d2f7c

                SHA256

                1f53af27663bc98b6fe6730ac3417da72dcf969ca2040d629bab2a704a640ed2

                SHA512

                e7669ab6b81b8c0f794ccf019cf092d99cb0e6f142fb69cca7974b690f503bc80c646b9b045fc573e41eb34a6e759813f0f9ceb38c50ae582863826248c4a2a1

              • C:\Users\Admin\AppData\Local\Temp\RES3F27.tmp

                Filesize

                5KB

                MD5

                a5b09bec21f8feba6200269a952afb49

                SHA1

                c5afa43347acb6da3877f3f614478152109894e0

                SHA256

                53cd27d7dd44d534f7d4b73ba6c25c3684025c92763d02f78e801e29b549ee4d

                SHA512

                cb73ff0e6e189dd85882462f7e926741d78ded8d720b59b497b98f1aec881f3a24521c865160f112b65fb24e1ad653554a8c5af9f4eb71dbbce281688bd5929b

              • C:\Users\Admin\AppData\Local\Temp\RES414A.tmp

                Filesize

                5KB

                MD5

                39d6b960a56a61775701ed0987ecc75e

                SHA1

                be73c1e42bde807aa24226d7d0a5fff388d94bb7

                SHA256

                bc74a92ff30c5929a2f5361809b94352a4e87a62b526ea08eaac8221d29f674a

                SHA512

                a5602ed237c857ff00f102f32ebc7ba8455f814f49c4033b156bc406971d20fea9a575ad0f57664b1e86641c55e533169ee454d3a0f55728f259532a43cef055

              • C:\Users\Admin\AppData\Local\Temp\RES436D.tmp

                Filesize

                5KB

                MD5

                d35e2e06f672dbfe153a596efc727514

                SHA1

                39e5b594866ff9de0b3d033c909ea79b8e60549b

                SHA256

                7179998268f7c180e70ce111833f174478eaca9e867a9f06c1e878af4713f6b4

                SHA512

                848c26cbd7e6ca047b04240535a39b00c49823b64924715a59568e0d98536f30e10672adb837a2edc005c6bfd30448bcad69819fbc4d0a6b7b0280207b053590

              • C:\Users\Admin\AppData\Local\Temp\RES4541.tmp

                Filesize

                5KB

                MD5

                3bd296c48952232c140019d56db8c055

                SHA1

                fd78e18f74ebdad112f905750ffb01cb11076d95

                SHA256

                b1cb771c392a9ae9546ccc0c9ef97a6f8c62942c3fe89b540c4caefa06fdb307

                SHA512

                2ca33d2b56a085975274c147b3ae03b2f69fd860a8c3dc2586af2d8ad5ce19a7842f5c0c64db0a4546075b58aad7e9b036346f47a3baeaaf71a3393fcd00660c

              • C:\Users\Admin\AppData\Local\Temp\RES4735.tmp

                Filesize

                5KB

                MD5

                f03f9bd524c54439b718759105298c6e

                SHA1

                ee17f35c95b5477b0ae7867bd23b2f2006f4f25d

                SHA256

                dd54aed71e33bd0e954b07f1b646b973f040639d84fa7df87a254561255bee1c

                SHA512

                abb6f6ca226ce1865aed55b99b0d9cdab96c81f241b4b122d099efe317279886f72d3c3e51d590542f85bcf3fdc4e029b7d1baee54fa7841a89e33981ae2aada

              • C:\Users\Admin\AppData\Local\Temp\RES49F5.tmp

                Filesize

                5KB

                MD5

                4e8b5b99a09d832324b3e3e3f703eaeb

                SHA1

                933d8a8874a5c64152528739d73d48d2794445d2

                SHA256

                982d43ac90196ad10f633b58fe681e3403d917a7abad26646671a9ebaee0be12

                SHA512

                ec02d81d55063ffed4a0e1c93d77709bf9e4e2ffb0a9eafc70f955dc38f75717ec2eeff9736c26d5031a4dc00bf904797500a6846c20f3853b5214a5ec2d8fc8

              • C:\Users\Admin\AppData\Local\Temp\RES4C17.tmp

                Filesize

                5KB

                MD5

                278d6d4dfd64c511a2aac25a268e4ea7

                SHA1

                d697ab70cd1d3e28646e892c64b7a62b8babfaf3

                SHA256

                b702edb239084923738a87bf001b46098428f65a3904542a0d4f35115e5ca144

                SHA512

                0f3272ae03cf79f4f9ca3a27c39f6a48554c7dd96e46abbf9fdf7a78062eeb9ef5a6e35197fd496c993b6b66c7c88beac3f0b390be34adf4ca82dfa9cc4e9bed

              • C:\Users\Admin\AppData\Local\Temp\RES4E4A.tmp

                Filesize

                5KB

                MD5

                fc187b6190c934f1753fec9a5448e038

                SHA1

                62bce5e1a8e555c5f2028f0b650a8587372821a5

                SHA256

                e45b5dfaed7e1909c04248eee1882bd02fb04368e4777fe1e2d338ce2b3e812a

                SHA512

                59ecd79850d0e62cb6b92d9fc534aaa09bc2aba7dee37c6fd79fe5347b41ab6d85d8642682326f614134644f60f01019516e70f4d51cacc4dde8b6ae0e3e6f72

              • C:\Users\Admin\AppData\Local\Temp\RES4FD1.tmp

                Filesize

                5KB

                MD5

                38f5c1fb5dfcb10be579f26ff27441a4

                SHA1

                510184d0f996ed0a442a580f5a1fbe65ca44bafc

                SHA256

                8b9fc37e6c9dc676e3cf66080e3d37bde97c54b86aecc0758ee6ea94f3d3fef6

                SHA512

                37cd620cf0591a9f97970473ccc06fe34d79a0182241fc5993f76381caee8839a8c7ab712a5b5c01af33b20bc03c2ad70077d4bbc64861f61154b1fd1bf735b7

              • C:\Users\Admin\AppData\Local\Temp\cggrkb4g.0.vb

                Filesize

                373B

                MD5

                1d051ff4cd0a27121e93aeb23d1df6ef

                SHA1

                4c66c8113b537573b9e54193605009ef612d0ee9

                SHA256

                c052ad284c34c0af73d878521251ca7bad9a390e5e7e3b2422dc0f5ca86f4b82

                SHA512

                501b5eb718214634c3386ad9a6df7dd48d9a75d4ecbdc2217d1e785e04e725d899a173b06354b21abb16e976e98a1869792cfa1618069090005425bf9472bb38

              • C:\Users\Admin\AppData\Local\Temp\cggrkb4g.cmdline

                Filesize

                269B

                MD5

                21af0e4259346322b6d6e51d64c19ef1

                SHA1

                ce6ac44942c47010cbb843717812ede1e2a77300

                SHA256

                4c08c2f6a85ba36bdf6c7ace11488ede11f2f0af9bb19228322179452b856470

                SHA512

                4b576b56fa57dd6b165585cb0b4bef78af2d3af6dfe76f9ee10d6319264becdbecb984a338773d3682b1b19f4e2424e252fdc0e204011c077f373f8fb5b23812

              • C:\Users\Admin\AppData\Local\Temp\o_np6yby.0.vb

                Filesize

                371B

                MD5

                556472f96ba0a829d9cd7592411c2347

                SHA1

                a2fae1bb654469d975926c75b9635a169a80c76b

                SHA256

                6589cfed04466d3dc448361f54572309a731aa8d54aacf50aade28c0f9225679

                SHA512

                a938b6b875dd8be3e942cb4c9939f7718ef930d1feddba516070fc5a308065e8c7ebe7ebd606e3fcf61d25a06d9197b3285043f85dd7c69b072cd9daf90f414a

              • C:\Users\Admin\AppData\Local\Temp\o_np6yby.cmdline

                Filesize

                265B

                MD5

                903b2bd2052b3ca5768047bbfcc234ec

                SHA1

                c817f07ac351d833d45e1c49b995fd4c62e3ca3c

                SHA256

                a891d13d81bd82e462b181dad960440e22e37e88f9eb06e8ab7b53322541adeb

                SHA512

                f62bebd456a041cf27594fa0646d7b9722b9f4e1a2631a058af9ce3d68ad6613616427697f81efab528d324e34bd3a28a8079b4e3519ff817a7033653848e900

              • C:\Users\Admin\AppData\Local\Temp\r3k6k4ha.0.vb

                Filesize

                371B

                MD5

                846365ec5052d6dabd406c35fb9393cd

                SHA1

                9abf408ca3938f0acbfc6eab9fccd33b4cfc43b0

                SHA256

                f1c039830bf9f701f465510cf16ae094214fcfc23a3c311adee9e6f4c18851b3

                SHA512

                cf3a29a98a1a53982bd6afbc8dc61b954c26138f9b85473b8a3297ca7ee3c3b782a3b6edde8b0dbbe406bd26e52d72c40a0c1d58dbdfb40c8f9e461bd6542b2d

              • C:\Users\Admin\AppData\Local\Temp\r3k6k4ha.cmdline

                Filesize

                265B

                MD5

                b262c768d617c0b9ed0155fa2b25f3f2

                SHA1

                59334fe8476320dece78b48d66eb93b1fb439564

                SHA256

                ec1e7a30d8fb5af9dfd717e23b427c597e029b5091d7c9bfc51d24bcdb24825e

                SHA512

                b6a4625cc0add0860e17beed9060d230cb894ccaec36c8105c73dbce94bf1d33e6c2408beb0ee94aaaa6fe36d9aacfcf9a761f8a9d3d4d6bd81b8a0b88e861c2

              • C:\Users\Admin\AppData\Local\Temp\rfvkhhoj.0.vb

                Filesize

                364B

                MD5

                a44396dac48f30ef8c8608531567fb83

                SHA1

                905391559e0577fbc6cefd0d13eb10f9dbcd63c3

                SHA256

                1ba098682cded71da604d1c99018e43622cf0bd8a609c0c6e2752e9ff1944b4f

                SHA512

                168ef2aa0bcc07f4e1a1f6652c8d459cd6c3c31ee579702e06977733da856419c9ebd1f2da06fdd185655dc464cd40183ddb32cfe0e960bc6104c64fdc9976fc

              • C:\Users\Admin\AppData\Local\Temp\rfvkhhoj.cmdline

                Filesize

                251B

                MD5

                d5bab84e10a4a0f45a5a047fef86b54c

                SHA1

                bac73d26ad2823fc1d114509cc267aec08802b6f

                SHA256

                ab2e7a917737005632a95922e25beede7b91295ce8cd7d8a31164310755a7181

                SHA512

                11e610cb410c97f35b6ea096111c3e1e4c17d76ff5041eb07c9b7612ede7838f628c5790d2f5b611ec251da65edd5e7b470144a58925d517e84e94e0ba83a20b

              • C:\Users\Admin\AppData\Local\Temp\sxcjwx11.0.vb

                Filesize

                370B

                MD5

                70829c1a9fba55df73e0bb03cc02dfba

                SHA1

                e0eb831dfee7c9daf3856af584d62c4cb202e852

                SHA256

                70274ebc993bc093082ff93802e33a7107df02aee8d392fe723459d31bba7fe0

                SHA512

                47eeac79275c292076c22348179543e3e3aa26c51c759d72c42362799437a761dc7707640b3634572b0c1e80b64fd82feae271ed45e06794976278a51252433a

              • C:\Users\Admin\AppData\Local\Temp\sxcjwx11.cmdline

                Filesize

                263B

                MD5

                ed218b2c1318ddf8ad6fa56ff060afa4

                SHA1

                107255d82e6ca555eaf2b563afb9e1e7639db725

                SHA256

                c6a7847203c1f1ab0756ad2debc713dd6be5041057f66c31d79ecb0ac21c672d

                SHA512

                809cb12decc9b779f6e91c90e7eae1f2bef71ee0a0b4042b59e61e5607f206a145bd13fef6972544fd7a18fc6070c67a2fd395edd3763268b9507a88f1b00647

              • C:\Users\Admin\AppData\Local\Temp\tx_3nxxj.0.vb

                Filesize

                364B

                MD5

                3c88d0389da097789f854d19e5a6851c

                SHA1

                9e0f6bb3a576bb0eaf7fa1384018e57b50401adf

                SHA256

                b0c7beac256055e2a91713ef20ab4bc9eb5785e2a7cd30f64ab95fe37ff4d60c

                SHA512

                92799b8e42dd602cb9686820bc75136e26f2f356a731c23e3a3c5d9f65ff0b2325666aebd1f34f4ebf240eb047a11e9a37751f3fa3e30264738e6c113f8d9ead

              • C:\Users\Admin\AppData\Local\Temp\tx_3nxxj.cmdline

                Filesize

                251B

                MD5

                7564f79e57c2c3183d80a43e9ef1067d

                SHA1

                7f320f7d2ae030d0e7768c4116faa429fd6779ff

                SHA256

                20b2678a60aac706aba743d33cef9ef84b501a4b6a9026bbcd5218f5ee966cf0

                SHA512

                fa1a1fb9dbd7056f8c9d71de08924ff0e54026e79c2f8f6fdff5115b8ec555a87340bda3e2c8d961b9eedcd9b6b19a5635d8dd893059d26e514c7a097aecf39f

              • C:\Users\Admin\AppData\Local\Temp\ubqc4dw4.0.vb

                Filesize

                368B

                MD5

                847182193015fc5d88f0c98c81c630ee

                SHA1

                7811018c8b8e5d6d01fb62972a426541635f7cf4

                SHA256

                08ebdceaef531c894727e6332a804ff5bead32831c6744ea1b52b22d420060a2

                SHA512

                1de1f111195e1f8d492c8ecd884d04fbb3b39f4781849c2d4d56085555844f34c2b6f6af15ea7a234fb6ed3b21f08deb19fc0238fd57f58df2b0cf1c59d0047c

              • C:\Users\Admin\AppData\Local\Temp\ubqc4dw4.cmdline

                Filesize

                259B

                MD5

                6262de0da3d7a1caf70081d43ddd4b21

                SHA1

                c8a7cd1223904ed449126c83b04dd4316f4639ca

                SHA256

                38e56d9725b767d8245dbd0e239c6ecbb07b49b1be3114f8a85ded38217d2e8c

                SHA512

                01b7c60976e97e005c19d60833296a2bf2c6a8daa5f739f49c5f15a74b1174ee7f61ab0934807ffbfb42c0e33dbb5f7a435405631e7bcc41f171bac72cd5560a

              • C:\Users\Admin\AppData\Local\Temp\vbc121F6A6089EB49019935FCE756FB50CC.TMP

                Filesize

                5KB

                MD5

                b07f007145f01b56abdfb53b487f0458

                SHA1

                9923c81f68e73be76b5f4964bdc4044334a415ae

                SHA256

                5c84e2e6f556654e4f4c0805c5a6a507fb9c1bbe02cc04fc05c2e8ee32e40c4e

                SHA512

                f635f804e1fd38b63bf5c128b711315e8da9bae51c0a906fcc6ace60d980dc23ab4cbe8613496771da23915359ce8bc2ae4e6a2261f039a46cd24e3ab9d78eab

              • C:\Users\Admin\AppData\Local\Temp\vbc259F23E86514A02A91B16569D98B669.TMP

                Filesize

                5KB

                MD5

                c3f8ad47348d4dc388b98c82291c4e3e

                SHA1

                f92b80d1a9467d4b6ef9604d82dbdc43d15bfe38

                SHA256

                609c321fc1bbce8a03476a1fd09100ad0148c33646804d58f9a1efd5e73e3b85

                SHA512

                74508a1cf26b23376d7e006786887f0057a970a17e9644871bbc6c642aeb799d86b71aa25ecfc986854c154ebe7db088270bf3b766cdfb71d1145cf67eea4c54

              • C:\Users\Admin\AppData\Local\Temp\vbc25DEC36FCFF443AB8C51DA8A7DE44891.TMP

                Filesize

                676B

                MD5

                85c61c03055878407f9433e0cc278eb7

                SHA1

                15a60f1519aefb81cb63c5993400dd7d31b1202f

                SHA256

                f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

                SHA512

                7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

              • C:\Users\Admin\AppData\Local\Temp\vbc2A457A0252A6466998BCFB2BE02A551F.TMP

                Filesize

                5KB

                MD5

                9a4a50d48b6d2a888bca457bce353fd7

                SHA1

                2cd6a91f297026f9e7b403b2a7f0b64050b4551b

                SHA256

                2713e5da2ad133a36377caea864c108db20eb5d0c5b86bb81ae409b2fab4aadd

                SHA512

                d1ab5d088d0dd1c20a0550d888f87e806e6139529e046dd479bb1af20153612b2fe81c12a8cf3ff4095796757e152d8d2fb5760b247d25208d219dea1b1a7a09

              • C:\Users\Admin\AppData\Local\Temp\vbc3D0FE588AB744C40A9B47C4984D593F.TMP

                Filesize

                5KB

                MD5

                387784f57a2f90edee143411c749a86f

                SHA1

                fa730a840a2caf64f612d65634f6940af8bc73f5

                SHA256

                2a6c05b939a7b9fe43b8f936c7deddf4d096e54ac2eeb7bd1aa022ebf5b69a63

                SHA512

                5d71d66db1278e7316a42d6dda97b04669ba137d371fa4798eaf311b9d9d78a4c441cbe404dde93569baf64403d2054d0e4834640d6c80dbf5b82602b2c80ea6

              • C:\Users\Admin\AppData\Local\Temp\vbc43F3992CC78A4991A2F0AA53296B21CF.TMP

                Filesize

                644B

                MD5

                dac60af34e6b37e2ce48ac2551aee4e7

                SHA1

                968c21d77c1f80b3e962d928c35893dbc8f12c09

                SHA256

                2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                SHA512

                1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

              • C:\Users\Admin\AppData\Local\Temp\vbc4DB7E5BDE8704F16AC2FC1D849A5782.TMP

                Filesize

                5KB

                MD5

                dae0bcef83564fd019409964995440a3

                SHA1

                72227ef8d352f83128124d59abced5453981017f

                SHA256

                bb59c081158d18030c797fe785ab434d2c7b512891b111a4cbabaeccfe43297d

                SHA512

                e88ce22701c011cd522f04bc4d81ae8515d5f1ddab762adbcd827a058fac7207a07b546876321184f36899768c6a2f13e3845eae258882748c544fde5a1b2558

              • C:\Users\Admin\AppData\Local\Temp\vbc798D2D55C7124A8EA3882376473DC7FF.TMP

                Filesize

                5KB

                MD5

                e5e552a63bec43aafd93067052091b70

                SHA1

                65d27ec9696e4eab2e9c9f03ce6a91330d194230

                SHA256

                19333143ba21e54fbaab635b061f7166a0db918057804cefd54e46586a0ccffb

                SHA512

                8703b20ea2ea148882430c4a13643978b9eb68212e74f257a8cf9d0cf56a1a7d285fe05663f8e43556ad2e802c27c8324751974cbb984dc5e7e54cb96b6063f6

              • C:\Users\Admin\AppData\Local\Temp\vbc87AD159ADF9346F3831EF55DF1729FA.TMP

                Filesize

                668B

                MD5

                3906bddee0286f09007add3cffcaa5d5

                SHA1

                0e7ec4da19db060ab3c90b19070d39699561aae2

                SHA256

                0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                SHA512

                0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

              • C:\Users\Admin\AppData\Local\Temp\vbc9D4D484C489144E0B057D89C9B731D2E.TMP

                Filesize

                5KB

                MD5

                161e68e923d56e4253270ef3afecb8ab

                SHA1

                7fd1bb35f3fd39f23a033861a4b92f4171545c69

                SHA256

                429dabd3474e79f2f7b456166e975c3f8760201b06f13b42bc4843f3b4dde419

                SHA512

                2f47d87471710b90b91d20eae71b666aa9dc124e42f39c5a63ab2df9131f9799133e5ed8c03d9385f5ba55988c62a99b96b7e056d61fb3e484e47de308f2a3b8

              • C:\Users\Admin\AppData\Local\Temp\vbcA79B9A91A9D48CEAE9B39D72AA4786.TMP

                Filesize

                5KB

                MD5

                707ccd65076784de34fd01c4aed82881

                SHA1

                3db7612956960ebb19ff7e1d9268506b639dc7c9

                SHA256

                945e1ccbc8e84b145d73102432bccf8040f77795424b1f7f0bfadb9add78d786

                SHA512

                767db8f7683c6256ef155f147fbd2202d22b2f91f2769e34de0ca5c8d525f04d9739647bb0e6f312d6f634366b6529fb83e2cafe153c727c861a9b6212d0dd34

              • C:\Users\Admin\AppData\Local\Temp\vbcBFDE3D297174448EAA5A9A701F1D96F5.TMP

                Filesize

                5KB

                MD5

                0951a669ef19737038b5a334186f1708

                SHA1

                53bbfbc282621ad57e7b091da3ae6a4ec0121596

                SHA256

                b582bab6100c6e758e62306f36f2693bc9ec729a95b4ffb5f3f715979efb6811

                SHA512

                7fde5deb696c18e2d7b5a94ea3a2af7aff25c593a364c366b6b5f70aefb618f38bddf6c64235a73ceb1e29a5c73d4e643dfec6e2aadafa23935e33ad77165a5b

              • C:\Users\Admin\AppData\Local\Temp\vbcC93E9BE37A814A21AE35A026723F9D5B.TMP

                Filesize

                5KB

                MD5

                5ae046a15bea3386071f0c63192ba29f

                SHA1

                94d51e6f2711362ade4879a29dba8f5abccdf884

                SHA256

                3b7d80821582922f747077294e51e2936cf3bc7dcf6ab999e83795a306e4b378

                SHA512

                29cb86aa3b76c1d1c2812baec48a036923050314450451b8fca317c2dd8dc3bbaffbd776cdb9d1f038aab703b5bfd91c8153e41a330dbba2671fc33ec7df2a03

              • C:\Users\Admin\AppData\Local\Temp\vbcDDA26D2097AE4282898862ADBD54C74.TMP

                Filesize

                5KB

                MD5

                8cb42e87bed9f4f5dddcfc0b4ed57515

                SHA1

                c5dadeac1347aedfb13eda2a7ec9040bead1147d

                SHA256

                968b017601126179c5c112428d2bb44b40ce26fa34ee82c34c363d5f582addbd

                SHA512

                bdcede0a75ea1f95aae11fab7755961cb27700b575cda72195511212567d8636f7feb9fb25b0b7b5ef03aca7b995d519839a761a579e58bda94fdba909fea2b4

              • C:\Users\Admin\AppData\Local\Temp\vbcF3B6C75C95CA45CE93283B50D0578F23.TMP

                Filesize

                5KB

                MD5

                cdb46c68f63ef379787c06e589936cbd

                SHA1

                0afcacbc9dbafe5ece918d2abd7e8c359a850c93

                SHA256

                e8afb68368eaff8356b363fb296aef4e2da063cddcf08e0b4a0e9d580fa9c84b

                SHA512

                083ba0fa6e8d08dd851be5671c50382a169416e1b8e623ace0cb6b9f98f1b02008947882509f19e646139d3129ab9cedf53b8bab5bf1bbc72f4377aad4ebf189

              • C:\Users\Admin\AppData\Local\Temp\vwfRtNH.txt

                Filesize

                44B

                MD5

                bfbee1ccbe6981fafb1c7bff99680882

                SHA1

                3866c915b8a7e0592f8728c89faf6bb4d5ecf002

                SHA256

                74976c31c2c46d066f3d9a70fc73b3a7dd541d5a889a6644a59f09b53960a235

                SHA512

                6bb98708f97b426a6ef445681a9169671d084f1a876e6ff07b8c595add8f996509d5e003a04b1d58ca10332285df2686bec4e6b470f6b3f8a19e15be256dbd2e

              • C:\Users\Admin\AppData\Local\Temp\w5nmb5cg.0.vb

                Filesize

                373B

                MD5

                adaa061d082a7b86bc1f959594a01eff

                SHA1

                9398852f8cfe36144a64ccded6b7775acdce59a9

                SHA256

                99391f66edd6bcddcc4c1f156572f4d193538b6e42793cf0694c97f02d6efc9c

                SHA512

                fc51f77ad8634b2a7512b76eac8cea3be9e04c5ff59b1fdedb6c0e99c71b7d4a5128b6f72fb217a8e7925371b98e0c94bc228c504125ae08cd3bb9daa26e6186

              • C:\Users\Admin\AppData\Local\Temp\w5nmb5cg.cmdline

                Filesize

                269B

                MD5

                07ae773d69cfaea762e7955c9197c412

                SHA1

                8827353fdde88eb29ac897a4256fda250e4580db

                SHA256

                59980788048d6698c14dd53a8f6b906b7e1ccb675e094855328ef068e12e2603

                SHA512

                b467ec33f44d973d324f4ee2af753b1704edbde00714695c82201629f6fb3501be1c33f028a2cf95231aad9db05606bd4e304baf30aa4d99ec4535daa1cb6cfa

              • C:\Users\Admin\AppData\Local\Temp\x_2e2kwe.0.vb

                Filesize

                350B

                MD5

                55baa1a9cc195fdeb239fd42886466ed

                SHA1

                21d56bd00b7bdefb6fd1f2735f2249cde0812132

                SHA256

                483fae1036126f05605dff2447307d8e840ff775f5cf7574fb5b0256beb95766

                SHA512

                8dc014a020e6ecda766b1f58928b1d10a20c5ea2e3973e94d8c339ea772044e3898004b753b9ff4020b436c543206f4ab46468b789d08466136baf0812e81daf

              • C:\Users\Admin\AppData\Local\Temp\x_2e2kwe.cmdline

                Filesize

                222B

                MD5

                4712e636222327f4f68bbc907e2363f7

                SHA1

                be8cb4fc78dd7a0b739f606daf9a4d08e1e62069

                SHA256

                8a073538384ac3bc1d5f6570dfc738fe746c763b4e54a0d4d7d90d14f0ded34f

                SHA512

                17e4ceda852ce70f17c62c9b86d29cac3cefdcca2bfd0c76d046eb8dbd9413b6a6bc96a9408bb0e7ea62085ce819b6bfcb0d181a87f3b75ec804646612946e03

              • C:\Users\Admin\AppData\Local\Temp\y4hqktk5.0.vb

                Filesize

                370B

                MD5

                31fc52bfcb5cf9a12d52b79c7dceaf11

                SHA1

                ec19379305a8404d3c86adb65782467d1c9c3b38

                SHA256

                2b2c31fe62190c52b62ece3e29a19af2309832922d627abd7b2900eab548c19e

                SHA512

                38679030edebf6272eb04b0ef9b0b432eef26b23e7c6a517518db3a15ba40bd33eba33835a5cafba2a9fbe73c90ba964cb6bcf375ae6a84dc75693008a8da627

              • C:\Users\Admin\AppData\Local\Temp\y4hqktk5.cmdline

                Filesize

                263B

                MD5

                e223687fdb5eaba9b16ecc5980b1a213

                SHA1

                da208a3776d0d0d4047ee8c5bbb2b76335c2c890

                SHA256

                ae658742a9c5a28d64567762fe339140e127e5d7fc9e6f7bdecb4872649bec4e

                SHA512

                d4f387ef0975bb8d2767f111049cdd62822cf3c432b03252a39033cbeca75093ee6430c3ece9989e4748c50afc051fe87d64836c5e0681916be3c7c9c61d2d11

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe

                Filesize

                5.0MB

                MD5

                6663483929f325b3fe2f8a351787aebf

                SHA1

                eaef70212f2f361a3167340d7c76e07246f1e427

                SHA256

                cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

                SHA512

                12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

              • memory/400-5-0x000000001C680000-0x000000001C6E2000-memory.dmp

                Filesize

                392KB

              • memory/400-8-0x00007FFD30B30000-0x00007FFD314D1000-memory.dmp

                Filesize

                9.6MB

              • memory/400-1-0x00007FFD30B30000-0x00007FFD314D1000-memory.dmp

                Filesize

                9.6MB

              • memory/400-0-0x00007FFD30DE5000-0x00007FFD30DE6000-memory.dmp

                Filesize

                4KB

              • memory/400-4-0x000000001BB10000-0x000000001BBB6000-memory.dmp

                Filesize

                664KB

              • memory/400-3-0x000000001C0F0000-0x000000001C5BE000-memory.dmp

                Filesize

                4.8MB

              • memory/400-2-0x00007FFD30B30000-0x00007FFD314D1000-memory.dmp

                Filesize

                9.6MB

              • memory/1768-309-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/4208-16-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/4208-15-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/4208-18-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/4208-14-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/5008-20-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/5008-19-0x0000000074972000-0x0000000074973000-memory.dmp

                Filesize

                4KB

              • memory/5008-305-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/5008-11-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/5008-10-0x0000000074970000-0x0000000074F21000-memory.dmp

                Filesize

                5.7MB

              • memory/5008-9-0x0000000074972000-0x0000000074973000-memory.dmp

                Filesize

                4KB

              • memory/5008-7-0x0000000000400000-0x0000000000422000-memory.dmp

                Filesize

                136KB