Resubmissions

22-11-2023 17:02

231122-vkac9adg64 10

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

  • max time kernel
    152s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-01-2021 19:24

General

  • Target

    42f972925508a82236e8533567487761(1).exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • aes_key

    DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo

  • anti_detection

    true

  • autorun

    true

  • bdos

    false

  • delay

  • host

    sandyclark255.hopto.org

  • hwid

  • install_file

  • install_folder

    %AppData%

  • mutex

    adweqsds56332

  • pastebin_config

    null

  • port

    6606,8808,7707

  • version

    0.5.6A

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 1 IoCs
  • Warzone RAT Payload 3 IoCs
  • Disables RegEdit via registry modification
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 6 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 131 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 102 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 164 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe
      "C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:32
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2480
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          4⤵
            PID:2004
      • C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe
        "C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe"
        2⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:284
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 284
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:2912
            • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
              "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3448
      • C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe
        "C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:1376
        • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
          "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2464
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            4⤵
              PID:748
            • C:\Users\Admin\Documents\excelsl.exe
              "C:\Users\Admin\Documents\excelsl.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3544
              • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1124
                • C:\Windows\SysWOW64\notepad.exe
                  notepad
                  6⤵
                    PID:2556
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1068
                  5⤵
                  • Program crash
                  PID:2388
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1040
                  5⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  PID:2412
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1068
              3⤵
              • Program crash
              • Suspicious use of AdjustPrivilegeToken
              PID:1324
          • C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe
            "C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:744
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
              3⤵
              • Creates scheduled task(s)
              PID:3900
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D58.tmp.bat""
              3⤵
                PID:8
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 3
                  4⤵
                  • Delays execution with timeout.exe
                  PID:312
                • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                  "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:1520
            • C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe
              "C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3748
              • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: GetForegroundWindowSpam
                PID:3928
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1068
                3⤵
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3164
            • C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe
              "C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:416
              • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
                3⤵
                • Executes dropped EXE
                PID:2652
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1076
                3⤵
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3916
              • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
                3⤵
                • Executes dropped EXE
                PID:644
            • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
              "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
              2⤵
              • Executes dropped EXE
              PID:3192
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1584
              2⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2768
            • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
              "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
              2⤵
              • Executes dropped EXE
              PID:3936

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Winlogon Helper DLL

          1
          T1004

          Modify Existing Service

          1
          T1031

          Registry Run Keys / Startup Folder

          1
          T1060

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Modify Registry

          2
          T1112

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
            MD5

            9d2a888ca79e1ff3820882ea1d88d574

            SHA1

            112c38d80bf2c0d48256249bbabe906b834b1f66

            SHA256

            8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

            SHA512

            17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

          • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
            MD5

            9d2a888ca79e1ff3820882ea1d88d574

            SHA1

            112c38d80bf2c0d48256249bbabe906b834b1f66

            SHA256

            8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

            SHA512

            17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

          • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe
            MD5

            590acb5fa6b5c3001ebce3d67242aac4

            SHA1

            5df39906dc4e60f01b95783fc55af6128402d611

            SHA256

            7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

            SHA512

            4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

          • C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe
            MD5

            590acb5fa6b5c3001ebce3d67242aac4

            SHA1

            5df39906dc4e60f01b95783fc55af6128402d611

            SHA256

            7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

            SHA512

            4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

          • C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            MD5

            9133c2a5ebf3e25aceae5a001ca6f279

            SHA1

            319f911282f3cded94de3730fa0abd5dec8f14be

            SHA256

            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

            SHA512

            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

          • C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
            MD5

            f07d2c33e4afe36ec6f6f14f9a56e84a

            SHA1

            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

            SHA256

            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

            SHA512

            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

          • C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe
            MD5

            e87459f61fd1f017d4bd6b0a1a1fc86a

            SHA1

            30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

            SHA256

            ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

            SHA512

            dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

          • C:\Users\Admin\AppData\Local\Temp\tmp3D58.tmp.bat
            MD5

            ebd97833eda31663c742e55f90baa96b

            SHA1

            e5224c45647a85516db6adb080b3329e4d4ea7f7

            SHA256

            1ae69530efc098f3738011cc66fbca183170a5c17bec4045be0f3544ddf1d9ee

            SHA512

            ef3859c060c4c95a88312314635fa606d3f1a21ac8602c605038b98911cc639a5e33442369f78add69275cb790ddea26400fbccc546e57a7078622e3e357b811

          • C:\Users\Admin\AppData\Roaming\prndrvest.exe
            MD5

            1f15227774cb80a52bf37a00eae6049d

            SHA1

            b2b82dddbce6b91ae15637cfd4ba82643f4d62bc

            SHA256

            9f6bf9843d562cdf3f43b1e4cd5b3b4592733b86a546023afe8cc01799561541

            SHA512

            5f1fd5bb3f3423cb569207a57391187a66753a9d73d6d52917f7eb4e3e836248ed4044273e4ea88671f006dfc46f51b590e1f2d1a46aad226df00e20ffb5fd03

          • C:\Users\Admin\AppData\Roaming\prndrvest.exe
            MD5

            1f15227774cb80a52bf37a00eae6049d

            SHA1

            b2b82dddbce6b91ae15637cfd4ba82643f4d62bc

            SHA256

            9f6bf9843d562cdf3f43b1e4cd5b3b4592733b86a546023afe8cc01799561541

            SHA512

            5f1fd5bb3f3423cb569207a57391187a66753a9d73d6d52917f7eb4e3e836248ed4044273e4ea88671f006dfc46f51b590e1f2d1a46aad226df00e20ffb5fd03

          • C:\Users\Admin\Documents\excelsl.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Users\Admin\Documents\excelsl.exe
            MD5

            3e804917c454ca31c1cbd602682542b7

            SHA1

            1df3e81b9d879e21af299f5478051b98f3cb7739

            SHA256

            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

            SHA512

            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

          • C:\Windows\svehosts.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • C:\Windows\svehosts.exe
            MD5

            2819e45588024ba76f248a39d3e232ba

            SHA1

            08a797b87ecfbee682ce14d872177dae1a5a46a2

            SHA256

            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

            SHA512

            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

          • memory/8-110-0x0000000000000000-mapping.dmp
          • memory/32-23-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
            Filesize

            4KB

          • memory/32-3-0x0000000000000000-mapping.dmp
          • memory/284-54-0x0000000000400000-0x00000000004C2000-memory.dmp
            Filesize

            776KB

          • memory/284-43-0x0000000000400000-0x00000000004C2000-memory.dmp
            Filesize

            776KB

          • memory/284-44-0x000000000046A08C-mapping.dmp
          • memory/312-112-0x0000000000000000-mapping.dmp
          • memory/416-32-0x00000000015E0000-0x00000000015E1000-memory.dmp
            Filesize

            4KB

          • memory/416-13-0x0000000000000000-mapping.dmp
          • memory/644-55-0x0000000000400000-0x0000000000554000-memory.dmp
            Filesize

            1.3MB

          • memory/644-61-0x0000000000400000-0x0000000000554000-memory.dmp
            Filesize

            1.3MB

          • memory/644-58-0x0000000000405CE2-mapping.dmp
          • memory/744-12-0x0000000000000000-mapping.dmp
          • memory/744-25-0x0000000000E30000-0x0000000000E31000-memory.dmp
            Filesize

            4KB

          • memory/744-40-0x0000000005973000-0x0000000005975000-memory.dmp
            Filesize

            8KB

          • memory/744-35-0x00000000019B0000-0x00000000019B1000-memory.dmp
            Filesize

            4KB

          • memory/744-64-0x0000000003130000-0x000000000313D000-memory.dmp
            Filesize

            52KB

          • memory/744-39-0x0000000005970000-0x0000000005971000-memory.dmp
            Filesize

            4KB

          • memory/744-90-0x000000000B290000-0x000000000B291000-memory.dmp
            Filesize

            4KB

          • memory/744-34-0x00000000057B0000-0x00000000057B1000-memory.dmp
            Filesize

            4KB

          • memory/744-31-0x0000000005D60000-0x0000000005D61000-memory.dmp
            Filesize

            4KB

          • memory/744-41-0x0000000005CE0000-0x0000000005CFD000-memory.dmp
            Filesize

            116KB

          • memory/744-106-0x000000000B6E0000-0x000000000B6E1000-memory.dmp
            Filesize

            4KB

          • memory/744-16-0x0000000070F60000-0x000000007164E000-memory.dmp
            Filesize

            6.9MB

          • memory/748-71-0x0000000000000000-mapping.dmp
          • memory/748-72-0x0000000003180000-0x0000000003181000-memory.dmp
            Filesize

            4KB

          • memory/1124-94-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/1124-92-0x000000000048F888-mapping.dmp
          • memory/1124-95-0x00000000028B0000-0x00000000028B1000-memory.dmp
            Filesize

            4KB

          • memory/1324-74-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
            Filesize

            4KB

          • memory/1324-70-0x00000000048A0000-0x00000000048A1000-memory.dmp
            Filesize

            4KB

          • memory/1376-9-0x0000000000000000-mapping.dmp
          • memory/1376-30-0x00000000025D0000-0x00000000025D1000-memory.dmp
            Filesize

            4KB

          • memory/1520-116-0x0000000070FB0000-0x000000007169E000-memory.dmp
            Filesize

            6.9MB

          • memory/1520-113-0x0000000000000000-mapping.dmp
          • memory/1520-122-0x00000000058E0000-0x00000000058E1000-memory.dmp
            Filesize

            4KB

          • memory/1520-123-0x00000000058E3000-0x00000000058E5000-memory.dmp
            Filesize

            8KB

          • memory/2004-108-0x0000000000000000-mapping.dmp
          • memory/2388-100-0x0000000004280000-0x0000000004281000-memory.dmp
            Filesize

            4KB

          • memory/2388-99-0x0000000004280000-0x0000000004281000-memory.dmp
            Filesize

            4KB

          • memory/2412-103-0x0000000004D70000-0x0000000004D71000-memory.dmp
            Filesize

            4KB

          • memory/2464-67-0x000000000048F888-mapping.dmp
          • memory/2464-77-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/2464-78-0x0000000001110000-0x0000000001111000-memory.dmp
            Filesize

            4KB

          • memory/2464-66-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/2480-73-0x0000000000000000-mapping.dmp
          • memory/2480-79-0x0000000002E80000-0x0000000002E81000-memory.dmp
            Filesize

            4KB

          • memory/2556-97-0x0000000000000000-mapping.dmp
          • memory/2556-98-0x00000000031D0000-0x00000000031D1000-memory.dmp
            Filesize

            4KB

          • memory/2612-2-0x0000000003150000-0x0000000003151000-memory.dmp
            Filesize

            4KB

          • memory/2768-36-0x0000000004540000-0x0000000004541000-memory.dmp
            Filesize

            4KB

          • memory/2768-37-0x0000000004540000-0x0000000004541000-memory.dmp
            Filesize

            4KB

          • memory/2836-27-0x0000000000910000-0x0000000000911000-memory.dmp
            Filesize

            4KB

          • memory/2836-6-0x0000000000000000-mapping.dmp
          • memory/2912-48-0x0000000000000000-mapping.dmp
          • memory/2912-56-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
            Filesize

            4KB

          • memory/3164-62-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
            Filesize

            4KB

          • memory/3192-24-0x0000000000400000-0x00000000004BA000-memory.dmp
            Filesize

            744KB

          • memory/3192-26-0x000000000048F888-mapping.dmp
          • memory/3448-89-0x0000000000400000-0x00000000004C2000-memory.dmp
            Filesize

            776KB

          • memory/3448-87-0x000000000046A08C-mapping.dmp
          • memory/3544-82-0x0000000000000000-mapping.dmp
          • memory/3544-85-0x0000000002C60000-0x0000000002C61000-memory.dmp
            Filesize

            4KB

          • memory/3748-33-0x0000000002F60000-0x0000000002F61000-memory.dmp
            Filesize

            4KB

          • memory/3748-17-0x0000000000000000-mapping.dmp
          • memory/3900-109-0x0000000000000000-mapping.dmp
          • memory/3916-63-0x00000000043A0000-0x00000000043A1000-memory.dmp
            Filesize

            4KB

          • memory/3928-47-0x0000000000400000-0x000000000040F000-memory.dmp
            Filesize

            60KB

          • memory/3928-49-0x000000000040715C-mapping.dmp
          • memory/3928-59-0x0000000000400000-0x000000000040F000-memory.dmp
            Filesize

            60KB