Malware Analysis Report

2025-08-06 01:48

Sample ID 241031-c4a5saxgpa
Target 31102024_0237_30102024_77954-668716095406000-20240826160944.pdf.gz
SHA256 11628243191e0ea5350275ee991781c35ce22f93635c2a613bd0ae5f49e442f1
Tags
remcos host discovery evasion execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

11628243191e0ea5350275ee991781c35ce22f93635c2a613bd0ae5f49e442f1

Threat Level: Known bad

The file 31102024_0237_30102024_77954-668716095406000-20240826160944.pdf.gz was found to be: Known bad.

Malicious Activity Summary

remcos host discovery evasion execution rat trojan

UAC bypass

Windows security bypass

Remcos family

Remcos

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Command and Scripting Interpreter: PowerShell

Windows security modification

Checks BIOS information in registry

Checks computer location settings

Checks whether UAC is enabled

Maps connected drives based on registry

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

System policy modification

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 02:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 02:37

Reported

2024-10-31 02:42

Platform

win7-20241023-en

Max time kernel

299s

Max time network

300s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe"

Signatures

Remcos

rat remcos

Remcos family

remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1372 set thread context of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Media Player\wmplayer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1372 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PID 1372 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"

C:\Program Files (x86)\Windows Media Player\wmplayer.exe

"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"

C:\Program Files (x86)\Windows Media Player\wmplayer.exe

"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 oyo.work.gd udp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp

Files

memory/1372-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

memory/1372-1-0x0000000000A30000-0x0000000000A44000-memory.dmp

memory/1372-2-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

memory/1372-3-0x000000001AA20000-0x000000001AAEE000-memory.dmp

memory/2088-6-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2088-13-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2088-12-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2088-11-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2088-10-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2088-9-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2088-8-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2088-4-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2928-18-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

memory/2188-37-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2188-43-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-40-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-39-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2928-19-0x0000000002250000-0x0000000002258000-memory.dmp

memory/1372-38-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

memory/2188-44-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-45-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-46-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-47-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-48-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-50-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-51-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-52-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-53-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-55-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-56-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-57-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-58-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-60-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-61-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-62-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-63-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-64-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-66-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-67-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-68-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-69-0x0000000000400000-0x000000000047F000-memory.dmp

C:\ProgramData\pdf\logs.dat

MD5 7f06237694441d6c770c3598ba4f95f2
SHA1 37b996c5dce136dcf6d434df9534b1b51960ac5f
SHA256 4dea512c815030dc89ae42d139fff37e27544eba7bbb2b0862c98f48de029d88
SHA512 dee250b5125bc3b9943ec7f191ff535ae6c67f1cd81cb8edbdb0e2897ff18318183cfd594786448128fdd631c0a623e2897b3084914ea62e01e8c0b32066196a

memory/2188-71-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-72-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-73-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-74-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-76-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-77-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-78-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-79-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-80-0x0000000000400000-0x000000000047F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 02:37

Reported

2024-10-31 02:42

Platform

win10v2004-20241007-en

Max time kernel

300s

Max time network

304s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe"

Signatures

Remcos

rat remcos

Remcos family

remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2388 set thread context of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2388 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2388 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\System32\svchost.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
PID 2388 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\77954-668716095406000-20240826160944.pdf.exe" -Force

C:\Windows\System32\svchost.exe

"C:\Windows\System32\svchost.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 oyo.work.gd udp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 154.216.20.185:3142 oyo.work.gd tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp
US 154.216.20.185:3142 oyo.work.gd tcp

Files

memory/2388-0-0x00000164E49F0000-0x00000164E4A04000-memory.dmp

memory/2388-1-0x00007FFB290C3000-0x00007FFB290C5000-memory.dmp

memory/2388-2-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

memory/2388-3-0x00000164E66A0000-0x00000164E676E000-memory.dmp

memory/4484-4-0x00000238FF780000-0x00000238FF7A2000-memory.dmp

memory/4484-10-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ajvl4gax.0zq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4484-15-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

memory/4484-17-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

memory/4388-16-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-18-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-19-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-23-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-21-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-24-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-25-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4484-28-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

memory/2388-29-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

memory/4388-30-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-31-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-33-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-34-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-35-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-37-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-38-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-39-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-40-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-42-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-43-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-44-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-46-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-47-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-48-0x0000000000400000-0x000000000047F000-memory.dmp

C:\ProgramData\pdf\logs.dat

MD5 375d2d2b9d88fa53c873a11188c34fc0
SHA1 caba0078ec7ef618c175758e6406dbad3bbf2d40
SHA256 5c47a8af74ff4ba640dd5032ba8b36838048db9deda6c9c6ce307953e821c44d
SHA512 0ad556eced9d2fc1068f7d9cd51288101811df831d5234bb019ae18e3ec47e32c976375ff8dc63ea933effc7d181bc99e3c592855b83f06914ca06204d83c6e4

memory/4388-50-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-51-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-53-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-54-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-55-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-56-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-58-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-59-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-61-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-62-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-63-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-64-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-66-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-67-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-69-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-70-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-71-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-73-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-74-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-75-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-77-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-78-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-79-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-81-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-82-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-83-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-85-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-86-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-87-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-89-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-90-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-91-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-93-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-94-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-96-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-97-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-98-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-99-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-101-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-102-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-104-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4388-105-0x0000000000400000-0x000000000047F000-memory.dmp