Analysis
-
max time kernel
60s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 11:40
Static task
static1
Behavioral task
behavioral1
Sample
42f972925508a82236e8533567487761.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
General
-
Target
42f972925508a82236e8533567487761.exe
-
Size
3.7MB
-
MD5
9d2a888ca79e1ff3820882ea1d88d574
-
SHA1
112c38d80bf2c0d48256249bbabe906b834b1f66
-
SHA256
8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
-
SHA512
17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
Malware Config
Extracted
warzonerat
sandyclark255.hopto.org:5200
Extracted
asyncrat
0.5.6A
sandyclark255.hopto.org:6606
sandyclark255.hopto.org:8808
sandyclark255.hopto.org:7707
adweqsds56332
-
aes_key
DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo
-
anti_detection
true
-
autorun
true
-
bdos
false
- delay
-
host
sandyclark255.hopto.org
- hwid
- install_file
-
install_folder
%AppData%
-
mutex
adweqsds56332
-
pastebin_config
null
-
port
6606,8808,7707
-
version
0.5.6A
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SCjYFuX3YkBwIZOm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\bgyZCikHTtsJ.exe\",explorer.exe" SCjYFuX3YkBwIZOm.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4204-61-0x0000000005250000-0x000000000525D000-memory.dmp asyncrat -
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1712-34-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/1712-38-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/1712-41-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 11 IoCs
Processes:
TdewNGjXxhKNoFzw.exeSCjYFuX3YkBwIZOm.exeZlRcg3eEBQRLuTBU.exe7YIdt7inzk31Eu4q.exe3XUu6OYUUwM7AcNu.exeNEqaYcYCw1Si5esy.exesvthost.exesvrhost.exeeridjeht.exesvehosts.exesvbhost.exepid process 3280 TdewNGjXxhKNoFzw.exe 3344 SCjYFuX3YkBwIZOm.exe 4152 ZlRcg3eEBQRLuTBU.exe 4204 7YIdt7inzk31Eu4q.exe 3932 3XUu6OYUUwM7AcNu.exe 3252 NEqaYcYCw1Si5esy.exe 3276 svthost.exe 1604 svrhost.exe 1712 eridjeht.exe 4412 svehosts.exe 2540 svbhost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
42f972925508a82236e8533567487761.exeNEqaYcYCw1Si5esy.exe3XUu6OYUUwM7AcNu.exeSCjYFuX3YkBwIZOm.exedescription pid process target process PID 4636 set thread context of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 3252 set thread context of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3932 set thread context of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3344 set thread context of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe -
Drops file in Windows directory 1 IoCs
Processes:
TdewNGjXxhKNoFzw.exedescription ioc process File created C:\Windows\svehosts.exe TdewNGjXxhKNoFzw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1196 4636 WerFault.exe 42f972925508a82236e8533567487761.exe 1592 3252 WerFault.exe NEqaYcYCw1Si5esy.exe 4088 3932 WerFault.exe 3XUu6OYUUwM7AcNu.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
42f972925508a82236e8533567487761.exeWerFault.exeNEqaYcYCw1Si5esy.exe3XUu6OYUUwM7AcNu.exeWerFault.exeWerFault.exeSCjYFuX3YkBwIZOm.exepid process 4636 42f972925508a82236e8533567487761.exe 4636 42f972925508a82236e8533567487761.exe 4636 42f972925508a82236e8533567487761.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 1196 WerFault.exe 3252 NEqaYcYCw1Si5esy.exe 3252 NEqaYcYCw1Si5esy.exe 3932 3XUu6OYUUwM7AcNu.exe 3932 3XUu6OYUUwM7AcNu.exe 3252 NEqaYcYCw1Si5esy.exe 3932 3XUu6OYUUwM7AcNu.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 1592 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 3344 SCjYFuX3YkBwIZOm.exe 3344 SCjYFuX3YkBwIZOm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svrhost.exepid process 1604 svrhost.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
42f972925508a82236e8533567487761.exeWerFault.exeTdewNGjXxhKNoFzw.exeNEqaYcYCw1Si5esy.exe3XUu6OYUUwM7AcNu.exe7YIdt7inzk31Eu4q.exeWerFault.exeWerFault.exesvehosts.exeSCjYFuX3YkBwIZOm.exedescription pid process Token: SeDebugPrivilege 4636 42f972925508a82236e8533567487761.exe Token: SeDebugPrivilege 4636 42f972925508a82236e8533567487761.exe Token: SeRestorePrivilege 1196 WerFault.exe Token: SeBackupPrivilege 1196 WerFault.exe Token: SeDebugPrivilege 1196 WerFault.exe Token: SeDebugPrivilege 3280 TdewNGjXxhKNoFzw.exe Token: SeDebugPrivilege 3280 TdewNGjXxhKNoFzw.exe Token: SeDebugPrivilege 3252 NEqaYcYCw1Si5esy.exe Token: SeDebugPrivilege 3932 3XUu6OYUUwM7AcNu.exe Token: SeDebugPrivilege 4204 7YIdt7inzk31Eu4q.exe Token: SeDebugPrivilege 1592 WerFault.exe Token: SeDebugPrivilege 4088 WerFault.exe Token: SeDebugPrivilege 4412 svehosts.exe Token: SeDebugPrivilege 4412 svehosts.exe Token: SeDebugPrivilege 3344 SCjYFuX3YkBwIZOm.exe Token: SeDebugPrivilege 3344 SCjYFuX3YkBwIZOm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42f972925508a82236e8533567487761.exeNEqaYcYCw1Si5esy.exe3XUu6OYUUwM7AcNu.exeTdewNGjXxhKNoFzw.exeSCjYFuX3YkBwIZOm.exedescription pid process target process PID 4636 wrote to memory of 3280 4636 42f972925508a82236e8533567487761.exe TdewNGjXxhKNoFzw.exe PID 4636 wrote to memory of 3280 4636 42f972925508a82236e8533567487761.exe TdewNGjXxhKNoFzw.exe PID 4636 wrote to memory of 3280 4636 42f972925508a82236e8533567487761.exe TdewNGjXxhKNoFzw.exe PID 4636 wrote to memory of 3344 4636 42f972925508a82236e8533567487761.exe SCjYFuX3YkBwIZOm.exe PID 4636 wrote to memory of 3344 4636 42f972925508a82236e8533567487761.exe SCjYFuX3YkBwIZOm.exe PID 4636 wrote to memory of 3344 4636 42f972925508a82236e8533567487761.exe SCjYFuX3YkBwIZOm.exe PID 4636 wrote to memory of 4152 4636 42f972925508a82236e8533567487761.exe ZlRcg3eEBQRLuTBU.exe PID 4636 wrote to memory of 4152 4636 42f972925508a82236e8533567487761.exe ZlRcg3eEBQRLuTBU.exe PID 4636 wrote to memory of 4152 4636 42f972925508a82236e8533567487761.exe ZlRcg3eEBQRLuTBU.exe PID 4636 wrote to memory of 4204 4636 42f972925508a82236e8533567487761.exe 7YIdt7inzk31Eu4q.exe PID 4636 wrote to memory of 4204 4636 42f972925508a82236e8533567487761.exe 7YIdt7inzk31Eu4q.exe PID 4636 wrote to memory of 4204 4636 42f972925508a82236e8533567487761.exe 7YIdt7inzk31Eu4q.exe PID 4636 wrote to memory of 3932 4636 42f972925508a82236e8533567487761.exe 3XUu6OYUUwM7AcNu.exe PID 4636 wrote to memory of 3932 4636 42f972925508a82236e8533567487761.exe 3XUu6OYUUwM7AcNu.exe PID 4636 wrote to memory of 3932 4636 42f972925508a82236e8533567487761.exe 3XUu6OYUUwM7AcNu.exe PID 4636 wrote to memory of 3252 4636 42f972925508a82236e8533567487761.exe NEqaYcYCw1Si5esy.exe PID 4636 wrote to memory of 3252 4636 42f972925508a82236e8533567487761.exe NEqaYcYCw1Si5esy.exe PID 4636 wrote to memory of 3252 4636 42f972925508a82236e8533567487761.exe NEqaYcYCw1Si5esy.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 4636 wrote to memory of 3276 4636 42f972925508a82236e8533567487761.exe svthost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3252 wrote to memory of 1604 3252 NEqaYcYCw1Si5esy.exe svrhost.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3932 wrote to memory of 1712 3932 3XUu6OYUUwM7AcNu.exe eridjeht.exe PID 3280 wrote to memory of 4412 3280 TdewNGjXxhKNoFzw.exe svehosts.exe PID 3280 wrote to memory of 4412 3280 TdewNGjXxhKNoFzw.exe svehosts.exe PID 3280 wrote to memory of 4412 3280 TdewNGjXxhKNoFzw.exe svehosts.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe PID 3344 wrote to memory of 2540 3344 SCjYFuX3YkBwIZOm.exe svbhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TdewNGjXxhKNoFzw.exe"C:\Users\Admin\AppData\Local\Temp\TdewNGjXxhKNoFzw.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\svehosts.exe"C:\Windows\svehosts.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SCjYFuX3YkBwIZOm.exe"C:\Users\Admin\AppData\Local\Temp\SCjYFuX3YkBwIZOm.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ZlRcg3eEBQRLuTBU.exe"C:\Users\Admin\AppData\Local\Temp\ZlRcg3eEBQRLuTBU.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7YIdt7inzk31Eu4q.exe"C:\Users\Admin\AppData\Local\Temp\7YIdt7inzk31Eu4q.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3XUu6OYUUwM7AcNu.exe"C:\Users\Admin\AppData\Local\Temp\3XUu6OYUUwM7AcNu.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 10683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NEqaYcYCw1Si5esy.exe"C:\Users\Admin\AppData\Local\Temp\NEqaYcYCw1Si5esy.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 10683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 15842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3XUu6OYUUwM7AcNu.exe
-
C:\Users\Admin\AppData\Local\Temp\3XUu6OYUUwM7AcNu.exe
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
-
C:\Users\Admin\AppData\Local\Temp\7YIdt7inzk31Eu4q.exe
-
C:\Users\Admin\AppData\Local\Temp\7YIdt7inzk31Eu4q.exeMD5
590acb5fa6b5c3001ebce3d67242aac4
SHA15df39906dc4e60f01b95783fc55af6128402d611
SHA2567bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA5124ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
-
C:\Users\Admin\AppData\Local\Temp\NEqaYcYCw1Si5esy.exe
-
C:\Users\Admin\AppData\Local\Temp\NEqaYcYCw1Si5esy.exe
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
-
C:\Users\Admin\AppData\Local\Temp\SCjYFuX3YkBwIZOm.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\SCjYFuX3YkBwIZOm.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\TdewNGjXxhKNoFzw.exeMD5
2819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Users\Admin\AppData\Local\Temp\TdewNGjXxhKNoFzw.exeMD5
2819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Users\Admin\AppData\Local\Temp\ZlRcg3eEBQRLuTBU.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\ZlRcg3eEBQRLuTBU.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
-
C:\Users\Admin\AppData\Local\Temp\tmp8ED3.tmp.bat
-
C:\Users\Admin\AppData\Roaming\prndrvest.exe
-
C:\Users\Admin\AppData\Roaming\prndrvest.exe
-
C:\Users\Admin\Documents\excelsl.exe
-
C:\Users\Admin\Documents\excelsl.exe
-
C:\Windows\svehosts.exe
-
C:\Windows\svehosts.exe
-
memory/216-83-0x000000000048F888-mapping.dmp
-
memory/216-82-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/216-86-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/364-131-0x0000000000000000-mapping.dmp
-
memory/364-132-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/364-135-0x0000000000000000-mapping.dmp
-
memory/440-111-0x0000000000000000-mapping.dmp
-
memory/1196-30-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/1196-27-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1196-26-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1592-56-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/1592-42-0x00000000046D0000-0x00000000046D1000-memory.dmpFilesize
4KB
-
memory/1604-37-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1604-32-0x000000000040715C-mapping.dmp
-
memory/1604-31-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1712-38-0x0000000000405CE2-mapping.dmp
-
memory/1712-34-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1712-41-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2112-128-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2112-126-0x000000000048F888-mapping.dmp
-
memory/2184-90-0x0000000000000000-mapping.dmp
-
memory/2184-94-0x0000000000000000-mapping.dmp
-
memory/2184-92-0x00000000026A0000-0x00000000026A1000-memory.dmpFilesize
4KB
-
memory/2540-75-0x000000000046A08C-mapping.dmp
-
memory/2540-74-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2540-78-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/3252-68-0x0000000000000000-mapping.dmp
-
memory/3252-48-0x0000000000000000-mapping.dmp
-
memory/3252-13-0x0000000000000000-mapping.dmp
-
memory/3252-63-0x0000000000000000-mapping.dmp
-
memory/3252-55-0x0000000000000000-mapping.dmp
-
memory/3252-60-0x0000000000000000-mapping.dmp
-
memory/3252-50-0x0000000000000000-mapping.dmp
-
memory/3252-58-0x0000000000000000-mapping.dmp
-
memory/3252-45-0x0000000000000000-mapping.dmp
-
memory/3252-52-0x0000000000000000-mapping.dmp
-
memory/3252-66-0x0000000000000000-mapping.dmp
-
memory/3252-44-0x0000000000000000-mapping.dmp
-
memory/3276-20-0x000000000048F888-mapping.dmp
-
memory/3276-19-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3280-0-0x0000000000000000-mapping.dmp
-
memory/3344-3-0x0000000000000000-mapping.dmp
-
memory/3864-79-0x0000000000000000-mapping.dmp
-
memory/3932-67-0x0000000000000000-mapping.dmp
-
memory/3932-46-0x0000000000000000-mapping.dmp
-
memory/3932-59-0x0000000000000000-mapping.dmp
-
memory/3932-62-0x0000000000000000-mapping.dmp
-
memory/3932-64-0x0000000000000000-mapping.dmp
-
memory/3932-51-0x0000000000000000-mapping.dmp
-
memory/3932-69-0x0000000000000000-mapping.dmp
-
memory/3932-10-0x0000000000000000-mapping.dmp
-
memory/3932-47-0x0000000000000000-mapping.dmp
-
memory/3932-49-0x0000000000000000-mapping.dmp
-
memory/3932-53-0x0000000000000000-mapping.dmp
-
memory/3932-54-0x0000000000000000-mapping.dmp
-
memory/4088-57-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/4088-43-0x0000000004220000-0x0000000004221000-memory.dmpFilesize
4KB
-
memory/4152-93-0x0000000000000000-mapping.dmp
-
memory/4152-99-0x0000000000000000-mapping.dmp
-
memory/4152-91-0x0000000000000000-mapping.dmp
-
memory/4152-89-0x0000000000000000-mapping.dmp
-
memory/4152-96-0x0000000000000000-mapping.dmp
-
memory/4152-88-0x0000000000000000-mapping.dmp
-
memory/4152-98-0x0000000000000000-mapping.dmp
-
memory/4152-101-0x0000000000000000-mapping.dmp
-
memory/4152-95-0x0000000000000000-mapping.dmp
-
memory/4152-103-0x0000000000000000-mapping.dmp
-
memory/4152-6-0x0000000000000000-mapping.dmp
-
memory/4152-102-0x0000000000000000-mapping.dmp
-
memory/4204-21-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/4204-29-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/4204-61-0x0000000005250000-0x000000000525D000-memory.dmpFilesize
52KB
-
memory/4204-24-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/4204-25-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/4204-7-0x0000000000000000-mapping.dmp
-
memory/4204-73-0x000000000A150000-0x000000000A151000-memory.dmpFilesize
4KB
-
memory/4204-81-0x000000000A490000-0x000000000A491000-memory.dmpFilesize
4KB
-
memory/4204-33-0x0000000009B70000-0x0000000009B8D000-memory.dmpFilesize
116KB
-
memory/4204-14-0x00000000712F0000-0x00000000719DE000-memory.dmpFilesize
6.9MB
-
memory/4320-87-0x00000000045D0000-0x00000000045D1000-memory.dmpFilesize
4KB
-
memory/4320-97-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/4412-70-0x0000000000000000-mapping.dmp
-
memory/4572-136-0x0000000000000000-mapping.dmp
-
memory/4572-134-0x0000000000000000-mapping.dmp
-
memory/4572-142-0x0000000000000000-mapping.dmp
-
memory/4572-141-0x0000000000000000-mapping.dmp
-
memory/4572-144-0x0000000000000000-mapping.dmp
-
memory/4572-145-0x0000000000000000-mapping.dmp
-
memory/4572-139-0x0000000000000000-mapping.dmp
-
memory/4572-100-0x0000000000000000-mapping.dmp
-
memory/4572-133-0x0000000000000000-mapping.dmp
-
memory/4572-143-0x0000000000000000-mapping.dmp
-
memory/4572-137-0x0000000000000000-mapping.dmp
-
memory/4572-138-0x0000000000000000-mapping.dmp
-
memory/4704-108-0x000000000046A08C-mapping.dmp
-
memory/4704-110-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/4728-119-0x0000000071310000-0x00000000719FE000-memory.dmpFilesize
6.9MB
-
memory/4728-115-0x0000000000000000-mapping.dmp
-
memory/4728-116-0x0000000000000000-mapping.dmp
-
memory/4764-114-0x0000000000000000-mapping.dmp
-
memory/4792-106-0x0000000000000000-mapping.dmp
-
memory/5092-112-0x0000000000000000-mapping.dmp
-
memory/5116-140-0x00000000051A0000-0x00000000051A1000-memory.dmpFilesize
4KB
-
memory/5116-129-0x00000000045D0000-0x00000000045D1000-memory.dmpFilesize
4KB