Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    154s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-01-2021 19:24

General

  • Target

    42f972925508a82236e8533567487761.exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • aes_key

    DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo

  • anti_detection

    true

  • autorun

    true

  • bdos

    false

  • delay

  • host

    sandyclark255.hopto.org

  • hwid

  • install_file

  • install_folder

    %AppData%

  • mutex

    adweqsds56332

  • pastebin_config

    null

  • port

    6606,8808,7707

  • version

    0.5.6A

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 1 IoCs
  • Warzone RAT Payload 3 IoCs
  • Disables RegEdit via registry modification
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 6 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 136 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 104 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 164 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exe
      "C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4056
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:3864
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          4⤵
            PID:4556
      • C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exe
        "C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exe"
        2⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:816
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 816
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1268
            • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
              "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3996
      • C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exe
        "C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:3620
        • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
          "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
          3⤵
          • Executes dropped EXE
          PID:2068
        • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
          "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:908
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            4⤵
              PID:1668
            • C:\Users\Admin\Documents\excelsl.exe
              "C:\Users\Admin\Documents\excelsl.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3592
              • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                5⤵
                • Executes dropped EXE
                PID:2252
              • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:4108
                • C:\Windows\SysWOW64\notepad.exe
                  notepad
                  6⤵
                    PID:4172
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 1080
                  5⤵
                  • Program crash
                  PID:4144
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 1076
              3⤵
              • Program crash
              • Suspicious use of AdjustPrivilegeToken
              PID:2232
          • C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exe
            "C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2144
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
              3⤵
              • Creates scheduled task(s)
              PID:4504
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF9C7.tmp.bat""
              3⤵
                PID:4620
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 3
                  4⤵
                  • Delays execution with timeout.exe
                  PID:4668
                • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                  "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:4700
            • C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exe
              "C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1740
              • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: GetForegroundWindowSpam
                PID:2256
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1068
                3⤵
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3824
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1036
                3⤵
                • Suspicious use of NtCreateProcessExOtherParentProcess
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1248
            • C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exe
              "C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2636
              • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
                3⤵
                • Executes dropped EXE
                PID:4040
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 1068
                3⤵
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2664
            • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
              "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
              2⤵
              • Executes dropped EXE
              PID:4028
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1576
              2⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2028

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
            MD5

            9d2a888ca79e1ff3820882ea1d88d574

            SHA1

            112c38d80bf2c0d48256249bbabe906b834b1f66

            SHA256

            8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

            SHA512

            17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

          • C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exe
            MD5

            590acb5fa6b5c3001ebce3d67242aac4

            SHA1

            5df39906dc4e60f01b95783fc55af6128402d611

            SHA256

            7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

            SHA512

            4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

          • C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exe
            MD5

            590acb5fa6b5c3001ebce3d67242aac4

            SHA1

            5df39906dc4e60f01b95783fc55af6128402d611

            SHA256

            7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

            SHA512

            4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

          • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\tmpF9C7.tmp.bat
            MD5

            b0d6555bf68628ff0efe65449106140a

            SHA1

            1ae93343986665568294b846d741aec1bc950477

            SHA256

            3d253a60344b9a0bfb89859e17c20b5ce6989858526bb30715161652a642d86f

            SHA512

            edc684858fd2bc83d8544a373dfbbec5229e148f9304058bdb77fb2b7d79c71d2896dc5338824f73269e18f19e3645103c96c736c63b0df111b088c1494b4a5c

          • C:\Users\Admin\AppData\Roaming\prndrvest.exe
            MD5

            deb9a4b54bb42ec7f621ab7ce83d1df7

            SHA1

            f10407631370a3d0c37f3132542052b8d0952501

            SHA256

            e55ab911858f0d6b25c42f5476984d4077bd9155f38552ad71d2f2691364e13e

            SHA512

            aa29f66651c163a10c84c985b466045a396a376aa37b22997fcd5af3f8c8f049f97f79982b542afaa65d5fcde9f39ab3511e690af194a727dc0b08ae0acba745

          • C:\Users\Admin\AppData\Roaming\prndrvest.exe
            MD5

            deb9a4b54bb42ec7f621ab7ce83d1df7

            SHA1

            f10407631370a3d0c37f3132542052b8d0952501

            SHA256

            e55ab911858f0d6b25c42f5476984d4077bd9155f38552ad71d2f2691364e13e

            SHA512

            aa29f66651c163a10c84c985b466045a396a376aa37b22997fcd5af3f8c8f049f97f79982b542afaa65d5fcde9f39ab3511e690af194a727dc0b08ae0acba745

          • C:\Users\Admin\Documents\excelsl.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\Documents\excelsl.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Windows\svehosts.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • C:\Windows\svehosts.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • memory/816-46-0x0000000000400000-0x00000000004C2000-memory.dmp
            Filesize

            776KB

          • memory/816-41-0x000000000046A08C-mapping.dmp
          • memory/816-40-0x0000000000400000-0x00000000004C2000-memory.dmp
            Filesize

            776KB

          • memory/908-74-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/908-70-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/908-77-0x0000000000E10000-0x0000000000E11000-memory.dmp
            Filesize

            4KB

          • memory/908-71-0x000000000048F888-mapping.dmp
          • memory/1248-64-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
            Filesize

            4KB

          • memory/1268-44-0x0000000000000000-mapping.dmp
          • memory/1268-48-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
            Filesize

            4KB

          • memory/1288-22-0x0000000002580000-0x0000000002581000-memory.dmp
            Filesize

            4KB

          • memory/1288-6-0x0000000000000000-mapping.dmp
          • memory/1668-75-0x0000000000000000-mapping.dmp
          • memory/1668-76-0x0000000000750000-0x0000000000751000-memory.dmp
            Filesize

            4KB

          • memory/1740-24-0x0000000002C20000-0x0000000002C21000-memory.dmp
            Filesize

            4KB

          • memory/1740-16-0x0000000000000000-mapping.dmp
          • memory/2028-34-0x0000000004390000-0x0000000004391000-memory.dmp
            Filesize

            4KB

          • memory/2028-35-0x0000000004390000-0x0000000004391000-memory.dmp
            Filesize

            4KB

          • memory/2144-38-0x00000000055B0000-0x00000000055B1000-memory.dmp
            Filesize

            4KB

          • memory/2144-39-0x0000000005883000-0x0000000005885000-memory.dmp
            Filesize

            8KB

          • memory/2144-17-0x0000000070E20000-0x000000007150E000-memory.dmp
            Filesize

            6.9MB

          • memory/2144-59-0x0000000005060000-0x000000000506D000-memory.dmp
            Filesize

            52KB

          • memory/2144-28-0x0000000000D20000-0x0000000000D21000-memory.dmp
            Filesize

            4KB

          • memory/2144-89-0x0000000009D50000-0x0000000009D51000-memory.dmp
            Filesize

            4KB

          • memory/2144-32-0x0000000005C10000-0x0000000005C11000-memory.dmp
            Filesize

            4KB

          • memory/2144-90-0x000000000A1E0000-0x000000000A1E1000-memory.dmp
            Filesize

            4KB

          • memory/2144-10-0x0000000000000000-mapping.dmp
          • memory/2144-33-0x00000000055E0000-0x00000000055E1000-memory.dmp
            Filesize

            4KB

          • memory/2144-37-0x0000000005880000-0x0000000005881000-memory.dmp
            Filesize

            4KB

          • memory/2144-47-0x0000000005990000-0x00000000059AD000-memory.dmp
            Filesize

            116KB

          • memory/2232-78-0x00000000041C0000-0x00000000041C1000-memory.dmp
            Filesize

            4KB

          • memory/2256-49-0x0000000000400000-0x000000000040F000-memory.dmp
            Filesize

            60KB

          • memory/2256-50-0x000000000040715C-mapping.dmp
          • memory/2256-60-0x0000000000400000-0x000000000040F000-memory.dmp
            Filesize

            60KB

          • memory/2636-13-0x0000000000000000-mapping.dmp
          • memory/2636-29-0x0000000002D00000-0x0000000002D01000-memory.dmp
            Filesize

            4KB

          • memory/2664-63-0x0000000004F60000-0x0000000004F61000-memory.dmp
            Filesize

            4KB

          • memory/3164-2-0x00000000017A0000-0x00000000017A1000-memory.dmp
            Filesize

            4KB

          • memory/3592-84-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
            Filesize

            4KB

          • memory/3592-81-0x0000000000000000-mapping.dmp
          • memory/3620-26-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
            Filesize

            4KB

          • memory/3620-9-0x0000000000000000-mapping.dmp
          • memory/3824-56-0x00000000044A0000-0x00000000044A1000-memory.dmp
            Filesize

            4KB

          • memory/3824-53-0x00000000040A0000-0x00000000040A1000-memory.dmp
            Filesize

            4KB

          • memory/3864-65-0x0000000000000000-mapping.dmp
          • memory/3864-68-0x0000000002390000-0x0000000002391000-memory.dmp
            Filesize

            4KB

          • memory/3996-86-0x000000000046A08C-mapping.dmp
          • memory/3996-88-0x0000000000400000-0x00000000004C2000-memory.dmp
            Filesize

            776KB

          • memory/4028-27-0x000000000048F888-mapping.dmp
          • memory/4028-25-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/4040-54-0x0000000000400000-0x0000000000554000-memory.dmp
            Filesize

            1.3MB

          • memory/4040-55-0x0000000000405CE2-mapping.dmp
          • memory/4040-62-0x0000000000400000-0x0000000000554000-memory.dmp
            Filesize

            1.3MB

          • memory/4056-3-0x0000000000000000-mapping.dmp
          • memory/4056-20-0x0000000002650000-0x0000000002651000-memory.dmp
            Filesize

            4KB

          • memory/4108-93-0x000000000048F888-mapping.dmp
          • memory/4108-95-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/4108-153-0x00000000027E0000-0x00000000027E1000-memory.dmp
            Filesize

            4KB

          • memory/4144-125-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-135-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-104-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-105-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-107-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-106-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-108-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-109-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-110-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-111-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-112-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-113-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-114-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-115-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-116-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-117-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-118-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-119-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-120-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-121-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-122-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-123-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-124-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-102-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-126-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-127-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-128-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-129-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-130-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-131-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-132-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-133-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-134-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-103-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-137-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-136-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-138-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-139-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-140-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-141-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-142-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-143-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-144-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-145-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-146-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-147-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-148-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-149-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-150-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-151-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-99-0x00000000045B0000-0x00000000045B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-152-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-155-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-156-0x00000000049B0000-0x00000000049B1000-memory.dmp
            Filesize

            4KB

          • memory/4144-100-0x00000000045B0000-0x00000000045B1000-memory.dmp
            Filesize

            4KB

          • memory/4172-98-0x00000000008D0000-0x00000000008D1000-memory.dmp
            Filesize

            4KB

          • memory/4172-97-0x0000000000000000-mapping.dmp
          • memory/4504-158-0x0000000000000000-mapping.dmp
          • memory/4556-159-0x0000000000000000-mapping.dmp
          • memory/4620-160-0x0000000000000000-mapping.dmp
          • memory/4668-162-0x0000000000000000-mapping.dmp
          • memory/4700-163-0x0000000000000000-mapping.dmp
          • memory/4700-166-0x0000000070E40000-0x000000007152E000-memory.dmp
            Filesize

            6.9MB

          • memory/4700-172-0x0000000004B50000-0x0000000004B51000-memory.dmp
            Filesize

            4KB

          • memory/4700-173-0x0000000004B53000-0x0000000004B55000-memory.dmp
            Filesize

            8KB