Overview
overview
10Static
static
1008751be484...2d.dll
windows7_x64
1008751be484...2d.dll
windows10_x64
100a9f79abd4...51.exe
windows7_x64
30a9f79abd4...51.exe
windows10_x64
30di3x.bin.exe
windows7_x64
100di3x.bin.exe
windows10_x64
101.bin/1.exe
windows7_x64
101.bin/1.exe
windows10_x64
104a30275f14...ab.dll
windows7_x64
104a30275f14...ab.dll
windows10_x64
12019-09-02...10.exe
windows7_x64
102019-09-02...10.exe
windows10_x64
102b5e50bc30...ba.dll
windows7_x64
102b5e50bc30...ba.dll
windows10_x64
102c01b00772...eb.exe
windows7_x64
102c01b00772...eb.exe
windows10_x64
131.exe
windows7_x64
1031.exe
windows10_x64
103DMark 11 ...on.exe
windows7_x64
13DMark 11 ...on.exe
windows10_x64
142f9729255...61.exe
windows7_x64
1042f9729255...61.exe
windows10_x64
1042f9729255...1).exe
windows7_x64
1042f9729255...1).exe
windows10_x64
105da0116af4...18.exe
windows7_x64
85da0116af4...18.exe
windows10_x64
869c56d12ed...6b.exe
windows7_x64
1069c56d12ed...6b.exe
windows10_x64
106a9e7107c9...91.exe
windows7_x64
106a9e7107c9...91.exe
windows10_x64
10905d572f23...50.exe
windows7_x64
1905d572f23...50.exe
windows10_x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
154s -
max time network
128s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 19:24
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v20201028
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
0di3x.bin.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
0di3x.bin.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
1.bin/1.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
1.bin/1.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win7v20201028
Behavioral task
behavioral10
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v20201028
Behavioral task
behavioral11
Sample
2019-09-02_22-41-10.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7v20201028
Behavioral task
behavioral14
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v20201028
Behavioral task
behavioral15
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
31.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
3DMark 11 Advanced Edition.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
42f972925508a82236e8533567487761.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7v20201028
Behavioral task
behavioral26
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7v20201028
Behavioral task
behavioral28
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7v20201028
Behavioral task
behavioral30
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7v20201028
Behavioral task
behavioral32
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
General
-
Target
42f972925508a82236e8533567487761.exe
-
Size
3.7MB
-
MD5
9d2a888ca79e1ff3820882ea1d88d574
-
SHA1
112c38d80bf2c0d48256249bbabe906b834b1f66
-
SHA256
8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
-
SHA512
17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
Malware Config
Extracted
asyncrat
0.5.6A
sandyclark255.hopto.org:6606
sandyclark255.hopto.org:8808
sandyclark255.hopto.org:7707
adweqsds56332
-
aes_key
DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo
-
anti_detection
true
-
autorun
true
-
bdos
false
- delay
-
host
sandyclark255.hopto.org
- hwid
- install_file
-
install_folder
%AppData%
-
mutex
adweqsds56332
-
pastebin_config
null
-
port
6606,8808,7707
-
version
0.5.6A
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
WVZCnZJiZpxubpCq.exesvuhost.exesvbhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\k6Uxm0NXMMDJ.exe\",explorer.exe" WVZCnZJiZpxubpCq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe" svuhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\InPeX2CdYyUb.exe\",explorer.exe" svbhost.exe -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1248 created 1740 1248 WerFault.exe KwzBf8EgLSyIm1tL.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral22/memory/2144-59-0x0000000005060000-0x000000000506D000-memory.dmp asyncrat -
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral22/memory/4040-54-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral22/memory/4040-55-0x0000000000405CE2-mapping.dmp warzonerat behavioral22/memory/4040-62-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svuhost.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svuhost.exe -
Executes dropped EXE 19 IoCs
Processes:
NMyni1FipJA2QJJN.exeWVZCnZJiZpxubpCq.exe4IQE1eNIOAabuH5D.exe6ma2mqyN47UWXDIv.exe1HcVEtDysMthqzOH.exeKwzBf8EgLSyIm1tL.exesvthost.exesvbhost.exesvbhost.exesvrhost.exeeridjeht.exesvehosts.exesvuhost.exesvuhost.exeexcelsl.exesvbhost.exesvuhost.exesvuhost.exeprndrvest.exepid process 4056 NMyni1FipJA2QJJN.exe 1288 WVZCnZJiZpxubpCq.exe 3620 4IQE1eNIOAabuH5D.exe 2144 6ma2mqyN47UWXDIv.exe 2636 1HcVEtDysMthqzOH.exe 1740 KwzBf8EgLSyIm1tL.exe 4028 svthost.exe 816 svbhost.exe 1268 svbhost.exe 2256 svrhost.exe 4040 eridjeht.exe 3864 svehosts.exe 2068 svuhost.exe 908 svuhost.exe 3592 excelsl.exe 3996 svbhost.exe 2252 svuhost.exe 4108 svuhost.exe 4700 prndrvest.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svuhost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation svuhost.exe -
Drops startup file 2 IoCs
Processes:
svehosts.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe svehosts.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe svehosts.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svuhost.exesvuhost.exesvehosts.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe" svuhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe" svuhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .." svehosts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .." svehosts.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
42f972925508a82236e8533567487761.exeWVZCnZJiZpxubpCq.exeKwzBf8EgLSyIm1tL.exe1HcVEtDysMthqzOH.exe4IQE1eNIOAabuH5D.exesvbhost.exeexcelsl.exedescription pid process target process PID 3164 set thread context of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 1288 set thread context of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1740 set thread context of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 2636 set thread context of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 3620 set thread context of 908 3620 4IQE1eNIOAabuH5D.exe svuhost.exe PID 1268 set thread context of 3996 1268 svbhost.exe svbhost.exe PID 3592 set thread context of 4108 3592 excelsl.exe svuhost.exe -
Drops file in Windows directory 1 IoCs
Processes:
NMyni1FipJA2QJJN.exedescription ioc process File created C:\Windows\svehosts.exe NMyni1FipJA2QJJN.exe -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2028 3164 WerFault.exe 42f972925508a82236e8533567487761.exe 3824 1740 WerFault.exe KwzBf8EgLSyIm1tL.exe 2664 2636 WerFault.exe 1HcVEtDysMthqzOH.exe 1248 1740 WerFault.exe KwzBf8EgLSyIm1tL.exe 2232 3620 WerFault.exe 4IQE1eNIOAabuH5D.exe 4144 3592 WerFault.exe excelsl.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4668 timeout.exe -
Modifies registry class 1 IoCs
Processes:
svuhost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance svuhost.exe -
Suspicious behavior: EnumeratesProcesses 136 IoCs
Processes:
42f972925508a82236e8533567487761.exeWerFault.exeWVZCnZJiZpxubpCq.exeKwzBf8EgLSyIm1tL.exe1HcVEtDysMthqzOH.exeWerFault.exeWerFault.exeWerFault.exepid process 3164 42f972925508a82236e8533567487761.exe 3164 42f972925508a82236e8533567487761.exe 3164 42f972925508a82236e8533567487761.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 1288 WVZCnZJiZpxubpCq.exe 1288 WVZCnZJiZpxubpCq.exe 1740 KwzBf8EgLSyIm1tL.exe 1740 KwzBf8EgLSyIm1tL.exe 1740 KwzBf8EgLSyIm1tL.exe 2636 1HcVEtDysMthqzOH.exe 2636 1HcVEtDysMthqzOH.exe 2636 1HcVEtDysMthqzOH.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 3824 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe 1248 WerFault.exe 1248 WerFault.exe 1248 WerFault.exe 1248 WerFault.exe 1248 WerFault.exe 1248 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svrhost.exesvbhost.exepid process 2256 svrhost.exe 816 svbhost.exe -
Suspicious use of AdjustPrivilegeToken 104 IoCs
Processes:
42f972925508a82236e8533567487761.exeWerFault.exeNMyni1FipJA2QJJN.exeWVZCnZJiZpxubpCq.exeKwzBf8EgLSyIm1tL.exesvbhost.exe1HcVEtDysMthqzOH.exe6ma2mqyN47UWXDIv.exeWerFault.exeWerFault.exeWerFault.exe4IQE1eNIOAabuH5D.exesvuhost.exesvbhost.exeWerFault.exesvbhost.exesvehosts.exeexcelsl.exesvuhost.exedescription pid process Token: SeDebugPrivilege 3164 42f972925508a82236e8533567487761.exe Token: SeDebugPrivilege 3164 42f972925508a82236e8533567487761.exe Token: SeRestorePrivilege 2028 WerFault.exe Token: SeBackupPrivilege 2028 WerFault.exe Token: SeDebugPrivilege 2028 WerFault.exe Token: SeDebugPrivilege 4056 NMyni1FipJA2QJJN.exe Token: SeDebugPrivilege 4056 NMyni1FipJA2QJJN.exe Token: SeDebugPrivilege 1288 WVZCnZJiZpxubpCq.exe Token: SeDebugPrivilege 1288 WVZCnZJiZpxubpCq.exe Token: SeDebugPrivilege 1740 KwzBf8EgLSyIm1tL.exe Token: SeShutdownPrivilege 816 svbhost.exe Token: SeDebugPrivilege 816 svbhost.exe Token: SeTcbPrivilege 816 svbhost.exe Token: SeDebugPrivilege 2636 1HcVEtDysMthqzOH.exe Token: SeDebugPrivilege 2144 6ma2mqyN47UWXDIv.exe Token: SeDebugPrivilege 3824 WerFault.exe Token: SeDebugPrivilege 2664 WerFault.exe Token: SeDebugPrivilege 1248 WerFault.exe Token: SeDebugPrivilege 3620 4IQE1eNIOAabuH5D.exe Token: SeIncreaseQuotaPrivilege 908 svuhost.exe Token: SeSecurityPrivilege 908 svuhost.exe Token: SeTakeOwnershipPrivilege 908 svuhost.exe Token: SeLoadDriverPrivilege 908 svuhost.exe Token: SeSystemProfilePrivilege 908 svuhost.exe Token: SeSystemtimePrivilege 908 svuhost.exe Token: SeProfSingleProcessPrivilege 908 svuhost.exe Token: SeIncBasePriorityPrivilege 908 svuhost.exe Token: SeCreatePagefilePrivilege 908 svuhost.exe Token: SeBackupPrivilege 908 svuhost.exe Token: SeRestorePrivilege 908 svuhost.exe Token: SeShutdownPrivilege 908 svuhost.exe Token: SeDebugPrivilege 908 svuhost.exe Token: SeSystemEnvironmentPrivilege 908 svuhost.exe Token: SeChangeNotifyPrivilege 908 svuhost.exe Token: SeRemoteShutdownPrivilege 908 svuhost.exe Token: SeUndockPrivilege 908 svuhost.exe Token: SeManageVolumePrivilege 908 svuhost.exe Token: SeImpersonatePrivilege 908 svuhost.exe Token: SeCreateGlobalPrivilege 908 svuhost.exe Token: 33 908 svuhost.exe Token: 34 908 svuhost.exe Token: 35 908 svuhost.exe Token: 36 908 svuhost.exe Token: SeDebugPrivilege 1268 svbhost.exe Token: SeDebugPrivilege 2232 WerFault.exe Token: SeDebugPrivilege 1268 svbhost.exe Token: SeShutdownPrivilege 3996 svbhost.exe Token: SeDebugPrivilege 3996 svbhost.exe Token: SeTcbPrivilege 3996 svbhost.exe Token: SeDebugPrivilege 3864 svehosts.exe Token: SeDebugPrivilege 3864 svehosts.exe Token: SeDebugPrivilege 3592 excelsl.exe Token: SeIncreaseQuotaPrivilege 4108 svuhost.exe Token: SeSecurityPrivilege 4108 svuhost.exe Token: SeTakeOwnershipPrivilege 4108 svuhost.exe Token: SeLoadDriverPrivilege 4108 svuhost.exe Token: SeSystemProfilePrivilege 4108 svuhost.exe Token: SeSystemtimePrivilege 4108 svuhost.exe Token: SeProfSingleProcessPrivilege 4108 svuhost.exe Token: SeIncBasePriorityPrivilege 4108 svuhost.exe Token: SeCreatePagefilePrivilege 4108 svuhost.exe Token: SeBackupPrivilege 4108 svuhost.exe Token: SeRestorePrivilege 4108 svuhost.exe Token: SeShutdownPrivilege 4108 svuhost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
svbhost.exesvuhost.exepid process 816 svbhost.exe 4108 svuhost.exe -
Suspicious use of WriteProcessMemory 164 IoCs
Processes:
42f972925508a82236e8533567487761.exeWVZCnZJiZpxubpCq.exesvbhost.exeKwzBf8EgLSyIm1tL.exe1HcVEtDysMthqzOH.exedescription pid process target process PID 3164 wrote to memory of 4056 3164 42f972925508a82236e8533567487761.exe NMyni1FipJA2QJJN.exe PID 3164 wrote to memory of 4056 3164 42f972925508a82236e8533567487761.exe NMyni1FipJA2QJJN.exe PID 3164 wrote to memory of 4056 3164 42f972925508a82236e8533567487761.exe NMyni1FipJA2QJJN.exe PID 3164 wrote to memory of 1288 3164 42f972925508a82236e8533567487761.exe WVZCnZJiZpxubpCq.exe PID 3164 wrote to memory of 1288 3164 42f972925508a82236e8533567487761.exe WVZCnZJiZpxubpCq.exe PID 3164 wrote to memory of 1288 3164 42f972925508a82236e8533567487761.exe WVZCnZJiZpxubpCq.exe PID 3164 wrote to memory of 3620 3164 42f972925508a82236e8533567487761.exe 4IQE1eNIOAabuH5D.exe PID 3164 wrote to memory of 3620 3164 42f972925508a82236e8533567487761.exe 4IQE1eNIOAabuH5D.exe PID 3164 wrote to memory of 3620 3164 42f972925508a82236e8533567487761.exe 4IQE1eNIOAabuH5D.exe PID 3164 wrote to memory of 2144 3164 42f972925508a82236e8533567487761.exe 6ma2mqyN47UWXDIv.exe PID 3164 wrote to memory of 2144 3164 42f972925508a82236e8533567487761.exe 6ma2mqyN47UWXDIv.exe PID 3164 wrote to memory of 2144 3164 42f972925508a82236e8533567487761.exe 6ma2mqyN47UWXDIv.exe PID 3164 wrote to memory of 2636 3164 42f972925508a82236e8533567487761.exe 1HcVEtDysMthqzOH.exe PID 3164 wrote to memory of 2636 3164 42f972925508a82236e8533567487761.exe 1HcVEtDysMthqzOH.exe PID 3164 wrote to memory of 2636 3164 42f972925508a82236e8533567487761.exe 1HcVEtDysMthqzOH.exe PID 3164 wrote to memory of 1740 3164 42f972925508a82236e8533567487761.exe KwzBf8EgLSyIm1tL.exe PID 3164 wrote to memory of 1740 3164 42f972925508a82236e8533567487761.exe KwzBf8EgLSyIm1tL.exe PID 3164 wrote to memory of 1740 3164 42f972925508a82236e8533567487761.exe KwzBf8EgLSyIm1tL.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 3164 wrote to memory of 4028 3164 42f972925508a82236e8533567487761.exe svthost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 1288 wrote to memory of 816 1288 WVZCnZJiZpxubpCq.exe svbhost.exe PID 816 wrote to memory of 1268 816 svbhost.exe svbhost.exe PID 816 wrote to memory of 1268 816 svbhost.exe svbhost.exe PID 816 wrote to memory of 1268 816 svbhost.exe svbhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 1740 wrote to memory of 2256 1740 KwzBf8EgLSyIm1tL.exe svrhost.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe PID 2636 wrote to memory of 4040 2636 1HcVEtDysMthqzOH.exe eridjeht.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exe"C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\svehosts.exe"C:\Windows\svehosts.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3864 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE4⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exe"C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 8164⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exe"C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"3⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"3⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:908 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:1668
-
C:\Users\Admin\Documents\excelsl.exe"C:\Users\Admin\Documents\excelsl.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"5⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4108 -
C:\Windows\SysWOW64\notepad.exenotepad6⤵PID:4172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 10805⤵
- Program crash
PID:4144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 10763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exe"C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'3⤵
- Creates scheduled task(s)
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF9C7.tmp.bat""3⤵PID:4620
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:4668 -
C:\Users\Admin\AppData\Roaming\prndrvest.exe"C:\Users\Admin\AppData\Roaming\prndrvest.exe"4⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exe"C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 10683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 10363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exe"C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"3⤵
- Executes dropped EXE
PID:4040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 10683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵
- Executes dropped EXE
PID:4028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 15762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exeMD5
f07d2c33e4afe36ec6f6f14f9a56e84a
SHA13ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2
-
C:\Users\Admin\AppData\Local\Temp\1HcVEtDysMthqzOH.exeMD5
f07d2c33e4afe36ec6f6f14f9a56e84a
SHA13ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2
-
C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\4IQE1eNIOAabuH5D.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exeMD5
9d2a888ca79e1ff3820882ea1d88d574
SHA1112c38d80bf2c0d48256249bbabe906b834b1f66
SHA2568b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA51217a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
-
C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exeMD5
590acb5fa6b5c3001ebce3d67242aac4
SHA15df39906dc4e60f01b95783fc55af6128402d611
SHA2567bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA5124ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba
-
C:\Users\Admin\AppData\Local\Temp\6ma2mqyN47UWXDIv.exeMD5
590acb5fa6b5c3001ebce3d67242aac4
SHA15df39906dc4e60f01b95783fc55af6128402d611
SHA2567bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA5124ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exeMD5
e87459f61fd1f017d4bd6b0a1a1fc86a
SHA130838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exeMD5
e87459f61fd1f017d4bd6b0a1a1fc86a
SHA130838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2
-
C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exeMD5
e87459f61fd1f017d4bd6b0a1a1fc86a
SHA130838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2
-
C:\Users\Admin\AppData\Local\Temp\KwzBf8EgLSyIm1tL.exeMD5
e87459f61fd1f017d4bd6b0a1a1fc86a
SHA130838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2
-
C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exeMD5
2819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Users\Admin\AppData\Local\Temp\NMyni1FipJA2QJJN.exeMD5
2819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\WVZCnZJiZpxubpCq.exeMD5
9133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exeMD5
f07d2c33e4afe36ec6f6f14f9a56e84a
SHA13ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exeMD5
f07d2c33e4afe36ec6f6f14f9a56e84a
SHA13ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\tmpF9C7.tmp.batMD5
b0d6555bf68628ff0efe65449106140a
SHA11ae93343986665568294b846d741aec1bc950477
SHA2563d253a60344b9a0bfb89859e17c20b5ce6989858526bb30715161652a642d86f
SHA512edc684858fd2bc83d8544a373dfbbec5229e148f9304058bdb77fb2b7d79c71d2896dc5338824f73269e18f19e3645103c96c736c63b0df111b088c1494b4a5c
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeMD5
deb9a4b54bb42ec7f621ab7ce83d1df7
SHA1f10407631370a3d0c37f3132542052b8d0952501
SHA256e55ab911858f0d6b25c42f5476984d4077bd9155f38552ad71d2f2691364e13e
SHA512aa29f66651c163a10c84c985b466045a396a376aa37b22997fcd5af3f8c8f049f97f79982b542afaa65d5fcde9f39ab3511e690af194a727dc0b08ae0acba745
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeMD5
deb9a4b54bb42ec7f621ab7ce83d1df7
SHA1f10407631370a3d0c37f3132542052b8d0952501
SHA256e55ab911858f0d6b25c42f5476984d4077bd9155f38552ad71d2f2691364e13e
SHA512aa29f66651c163a10c84c985b466045a396a376aa37b22997fcd5af3f8c8f049f97f79982b542afaa65d5fcde9f39ab3511e690af194a727dc0b08ae0acba745
-
C:\Users\Admin\Documents\excelsl.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\Documents\excelsl.exeMD5
3e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Windows\svehosts.exeMD5
2819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Windows\svehosts.exeMD5
2819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
memory/816-46-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/816-41-0x000000000046A08C-mapping.dmp
-
memory/816-40-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/908-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/908-70-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/908-77-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/908-71-0x000000000048F888-mapping.dmp
-
memory/1248-64-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/1268-44-0x0000000000000000-mapping.dmp
-
memory/1268-48-0x0000000002FB0000-0x0000000002FB1000-memory.dmpFilesize
4KB
-
memory/1288-22-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/1288-6-0x0000000000000000-mapping.dmp
-
memory/1668-75-0x0000000000000000-mapping.dmp
-
memory/1668-76-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/1740-24-0x0000000002C20000-0x0000000002C21000-memory.dmpFilesize
4KB
-
memory/1740-16-0x0000000000000000-mapping.dmp
-
memory/2028-34-0x0000000004390000-0x0000000004391000-memory.dmpFilesize
4KB
-
memory/2028-35-0x0000000004390000-0x0000000004391000-memory.dmpFilesize
4KB
-
memory/2144-38-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/2144-39-0x0000000005883000-0x0000000005885000-memory.dmpFilesize
8KB
-
memory/2144-17-0x0000000070E20000-0x000000007150E000-memory.dmpFilesize
6.9MB
-
memory/2144-59-0x0000000005060000-0x000000000506D000-memory.dmpFilesize
52KB
-
memory/2144-28-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/2144-89-0x0000000009D50000-0x0000000009D51000-memory.dmpFilesize
4KB
-
memory/2144-32-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/2144-90-0x000000000A1E0000-0x000000000A1E1000-memory.dmpFilesize
4KB
-
memory/2144-10-0x0000000000000000-mapping.dmp
-
memory/2144-33-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/2144-37-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/2144-47-0x0000000005990000-0x00000000059AD000-memory.dmpFilesize
116KB
-
memory/2232-78-0x00000000041C0000-0x00000000041C1000-memory.dmpFilesize
4KB
-
memory/2256-49-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2256-50-0x000000000040715C-mapping.dmp
-
memory/2256-60-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2636-13-0x0000000000000000-mapping.dmp
-
memory/2636-29-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/2664-63-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/3164-2-0x00000000017A0000-0x00000000017A1000-memory.dmpFilesize
4KB
-
memory/3592-84-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/3592-81-0x0000000000000000-mapping.dmp
-
memory/3620-26-0x0000000002DE0000-0x0000000002DE1000-memory.dmpFilesize
4KB
-
memory/3620-9-0x0000000000000000-mapping.dmp
-
memory/3824-56-0x00000000044A0000-0x00000000044A1000-memory.dmpFilesize
4KB
-
memory/3824-53-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/3864-65-0x0000000000000000-mapping.dmp
-
memory/3864-68-0x0000000002390000-0x0000000002391000-memory.dmpFilesize
4KB
-
memory/3996-86-0x000000000046A08C-mapping.dmp
-
memory/3996-88-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/4028-27-0x000000000048F888-mapping.dmp
-
memory/4028-25-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4040-54-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/4040-55-0x0000000000405CE2-mapping.dmp
-
memory/4040-62-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/4056-3-0x0000000000000000-mapping.dmp
-
memory/4056-20-0x0000000002650000-0x0000000002651000-memory.dmpFilesize
4KB
-
memory/4108-93-0x000000000048F888-mapping.dmp
-
memory/4108-95-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4108-153-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/4144-125-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-135-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-104-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-105-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-107-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-106-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-108-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-109-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-110-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-111-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-112-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-113-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-114-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-115-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-116-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-117-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-118-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-119-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-120-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-121-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-122-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-123-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-124-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-102-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-126-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-127-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-128-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-129-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-130-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-131-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-132-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-133-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-134-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-103-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-137-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-136-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-138-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-139-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-140-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-141-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-142-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-143-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-144-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-145-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-146-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-147-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-148-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-149-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-150-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-151-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-99-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/4144-152-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-155-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-156-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4144-100-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/4172-98-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/4172-97-0x0000000000000000-mapping.dmp
-
memory/4504-158-0x0000000000000000-mapping.dmp
-
memory/4556-159-0x0000000000000000-mapping.dmp
-
memory/4620-160-0x0000000000000000-mapping.dmp
-
memory/4668-162-0x0000000000000000-mapping.dmp
-
memory/4700-163-0x0000000000000000-mapping.dmp
-
memory/4700-166-0x0000000070E40000-0x000000007152E000-memory.dmpFilesize
6.9MB
-
memory/4700-172-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/4700-173-0x0000000004B53000-0x0000000004B55000-memory.dmpFilesize
8KB