Resubmissions

20/05/2025, 20:23

250520-y572ss1qv8 10

20/05/2025, 20:10

250520-yx65jabr7v 10

14/05/2025, 08:25

250514-kbrwtsfk31 10

Analysis

  • max time kernel
    300s
  • max time network
    216s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2025, 20:10

General

  • Target

    42f972925508a82236e8533567487761.exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

  • SSDEEP

    98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

darkcomet

Botnet

2020NOV1

C2

sandyclark255.hopto.org:35887

Mutex

DC_MUTEX-6XT818D

Attributes
  • InstallPath

    excelsl.exe

  • gencode

    n7asq0Dbu7D2

  • install

    true

  • offline_keylogger

    true

  • password

    hhhhhh

  • persistence

    true

  • reg_key

    office

rc4.plain

Extracted

Family

babylonrat

C2

sandyclark255.hopto.org

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • delay

    5

  • install

    true

  • install_file

    prndrvest.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

  • Babylonrat family
  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • Njrat family
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 4 IoCs
  • Warzone RAT payload 2 IoCs
  • Disables RegEdit via registry modification 2 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 25 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\5slnormZYxsnEPtB.exe
      "C:\Users\Admin\AppData\Local\Temp\5slnormZYxsnEPtB.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3428
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4500
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1672
    • C:\Users\Admin\AppData\Local\Temp\rq1xuF4Tdc0HmeOv.exe
      "C:\Users\Admin\AppData\Local\Temp\rq1xuF4Tdc0HmeOv.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4896
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1000
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 1000
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4460
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4168
            • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
              "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 4168
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4432
              • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
                7⤵
                • Executes dropped EXE
                PID:2024
              • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
                7⤵
                • Executes dropped EXE
                PID:3580
    • C:\Users\Admin\AppData\Local\Temp\hFVAgLnzUA3y5SsJ.exe
      "C:\Users\Admin\AppData\Local\Temp\hFVAgLnzUA3y5SsJ.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Drops file in Drivers directory
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1548
        • C:\Users\Admin\Documents\excelsl.exe
          "C:\Users\Admin\Documents\excelsl.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2276
          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3976
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1096
            5⤵
            • Program crash
            PID:3052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1164
        3⤵
        • Program crash
        PID:3676
    • C:\Users\Admin\AppData\Local\Temp\opDE7UuA6oJNiNg0.exe
      "C:\Users\Admin\AppData\Local\Temp\opDE7UuA6oJNiNg0.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4016
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2908
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp73A4.tmp.bat""
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1816
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:2120
        • C:\Users\Admin\AppData\Roaming\prndrvest.exe
          "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4644
    • C:\Users\Admin\AppData\Local\Temp\BWPeMT5B5i5rigsz.exe
      "C:\Users\Admin\AppData\Local\Temp\BWPeMT5B5i5rigsz.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
        "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 1160
        3⤵
        • Program crash
        PID:3568
    • C:\Users\Admin\AppData\Local\Temp\0usq7aohwG8Z1UON.exe
      "C:\Users\Admin\AppData\Local\Temp\0usq7aohwG8Z1UON.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
        "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        PID:412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1148
        3⤵
        • Program crash
        PID:4524
    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
      "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
      2⤵
      • Executes dropped EXE
      PID:3812
    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
      "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
      2⤵
      • Executes dropped EXE
      PID:2244
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 1640
      2⤵
      • Program crash
      PID:3068
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2456 -ip 2456
    1⤵
      PID:3612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4604 -ip 4604
      1⤵
        PID:4420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2016 -ip 2016
        1⤵
          PID:948
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2228 -ip 2228
          1⤵
            PID:3268
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\excelsl.exe
            1⤵
              PID:1656
              • C:\Users\Admin\Documents\excelsl.exe
                C:\Users\Admin\Documents\excelsl.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4420
                • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:744
                • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                  3⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:3964
                  • C:\Windows\SysWOW64\notepad.exe
                    notepad
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3644
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1148
                  3⤵
                  • Program crash
                  PID:2956
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4420 -ip 4420
              1⤵
                PID:2204
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2276 -ip 2276
                1⤵
                  PID:3020
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Windows\svehosts.exe" ..
                  1⤵
                    PID:4344
                    • C:\Windows\svehosts.exe
                      C:\Windows\svehosts.exe ..
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2132

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\excelsl.exe.log

                          Filesize

                          400B

                          MD5

                          0a9b4592cd49c3c21f6767c2dabda92f

                          SHA1

                          f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

                          SHA256

                          c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

                          SHA512

                          6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

                        • C:\Users\Admin\AppData\Local\Temp\0usq7aohwG8Z1UON.exe

                          Filesize

                          336KB

                          MD5

                          e87459f61fd1f017d4bd6b0a1a1fc86a

                          SHA1

                          30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                          SHA256

                          ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                          SHA512

                          dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                        • C:\Users\Admin\AppData\Local\Temp\5slnormZYxsnEPtB.exe

                          Filesize

                          472KB

                          MD5

                          2819e45588024ba76f248a39d3e232ba

                          SHA1

                          08a797b87ecfbee682ce14d872177dae1a5a46a2

                          SHA256

                          b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                          SHA512

                          a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

                          Filesize

                          3.7MB

                          MD5

                          9d2a888ca79e1ff3820882ea1d88d574

                          SHA1

                          112c38d80bf2c0d48256249bbabe906b834b1f66

                          SHA256

                          8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

                          SHA512

                          17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

                        • C:\Users\Admin\AppData\Local\Temp\BWPeMT5B5i5rigsz.exe

                          Filesize

                          366KB

                          MD5

                          f07d2c33e4afe36ec6f6f14f9a56e84a

                          SHA1

                          3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                          SHA256

                          309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                          SHA512

                          b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                        • C:\Users\Admin\AppData\Local\Temp\hFVAgLnzUA3y5SsJ.exe

                          Filesize

                          742KB

                          MD5

                          3e804917c454ca31c1cbd602682542b7

                          SHA1

                          1df3e81b9d879e21af299f5478051b98f3cb7739

                          SHA256

                          f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                          SHA512

                          28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                        • C:\Users\Admin\AppData\Local\Temp\opDE7UuA6oJNiNg0.exe

                          Filesize

                          376KB

                          MD5

                          590acb5fa6b5c3001ebce3d67242aac4

                          SHA1

                          5df39906dc4e60f01b95783fc55af6128402d611

                          SHA256

                          7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

                          SHA512

                          4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

                        • C:\Users\Admin\AppData\Local\Temp\rq1xuF4Tdc0HmeOv.exe

                          Filesize

                          801KB

                          MD5

                          9133c2a5ebf3e25aceae5a001ca6f279

                          SHA1

                          319f911282f3cded94de3730fa0abd5dec8f14be

                          SHA256

                          7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                          SHA512

                          1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                        • C:\Users\Admin\AppData\Local\Temp\tmp73A4.tmp.bat

                          Filesize

                          153B

                          MD5

                          7673b63024ff1e683aba14c1ad3ffdac

                          SHA1

                          2ded1709410f249e804a783168f7596579c4193a

                          SHA256

                          0e93fb4a87f59af57d22a54f6e863ba6690682b0c962973db8ecf19b9a327a91

                          SHA512

                          4e7b20141d917a418a08524f90a89de3dc480519b748e87b322e4142a1a777305ecf3444f63ede981b49a4d624ebd2ecb157be5eaaa2a1395dd54a3fa16b346e

                        • C:\Users\Admin\AppData\Roaming\prndrvest.exe

                          Filesize

                          39.5MB

                          MD5

                          d314437df3a59c091b45b00c0ae91f2b

                          SHA1

                          b4a499583a6a741ceeb5b70143037c5217f28557

                          SHA256

                          128446ea0e090ec8fecb771617b7561f4777b7617bfabd93b8a0e8c129600ee0

                          SHA512

                          d04bbbef7be7e60b3d7753e841723264193b1c7bc4eea73cbd9f3fe3621305d3c051f89ae32c61f6240b12db9a71f5474b44a6b93b1b0b411fdc367a256a47c9

                        • memory/412-94-0x0000000000400000-0x000000000040F000-memory.dmp

                          Filesize

                          60KB

                        • memory/412-91-0x0000000000400000-0x000000000040F000-memory.dmp

                          Filesize

                          60KB

                        • memory/620-100-0x0000000000400000-0x0000000000554000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/620-97-0x0000000000400000-0x0000000000554000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/1000-124-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-118-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-123-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-111-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-116-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-125-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-129-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-128-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1000-127-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/1548-134-0x0000000000C70000-0x0000000000C71000-memory.dmp

                          Filesize

                          4KB

                        • memory/2244-80-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/2456-3-0x0000000074AC2000-0x0000000074AC3000-memory.dmp

                          Filesize

                          4KB

                        • memory/2456-87-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/2456-1-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/2456-4-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/2456-2-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/2456-0-0x0000000074AC2000-0x0000000074AC3000-memory.dmp

                          Filesize

                          4KB

                        • memory/3428-102-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/3428-206-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/3428-37-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/3428-36-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/3428-34-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/3580-246-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/3644-236-0x0000000001410000-0x0000000001411000-memory.dmp

                          Filesize

                          4KB

                        • memory/3964-237-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/3964-233-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/3964-235-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/3964-238-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/3976-253-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/3976-252-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/4016-226-0x0000000009E10000-0x0000000009EAC000-memory.dmp

                          Filesize

                          624KB

                        • memory/4016-225-0x0000000006950000-0x00000000069B6000-memory.dmp

                          Filesize

                          408KB

                        • memory/4016-143-0x0000000005D10000-0x0000000005D22000-memory.dmp

                          Filesize

                          72KB

                        • memory/4016-85-0x0000000005900000-0x000000000590A000-memory.dmp

                          Filesize

                          40KB

                        • memory/4016-83-0x0000000005D20000-0x00000000062C4000-memory.dmp

                          Filesize

                          5.6MB

                        • memory/4016-82-0x0000000000E80000-0x0000000000EE4000-memory.dmp

                          Filesize

                          400KB

                        • memory/4016-88-0x0000000009950000-0x0000000009974000-memory.dmp

                          Filesize

                          144KB

                        • memory/4016-84-0x0000000005770000-0x0000000005802000-memory.dmp

                          Filesize

                          584KB

                        • memory/4016-142-0x0000000001820000-0x0000000001832000-memory.dmp

                          Filesize

                          72KB

                        • memory/4168-247-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4168-257-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4168-220-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4168-222-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4168-219-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4168-223-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4168-218-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4168-216-0x0000000000400000-0x00000000004C2000-memory.dmp

                          Filesize

                          776KB

                        • memory/4644-272-0x0000000000CE0000-0x0000000000D04000-memory.dmp

                          Filesize

                          144KB

                        • memory/4644-273-0x0000000004F90000-0x0000000004FA2000-memory.dmp

                          Filesize

                          72KB

                        • memory/4644-274-0x000000000A1A0000-0x000000000A1B2000-memory.dmp

                          Filesize

                          72KB

                        • memory/4872-120-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/4872-122-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/4872-109-0x0000000000400000-0x00000000004BA000-memory.dmp

                          Filesize

                          744KB

                        • memory/4896-135-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/4896-136-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/4896-192-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/4896-38-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB

                        • memory/4896-71-0x0000000074AC0000-0x0000000075071000-memory.dmp

                          Filesize

                          5.7MB