Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
769c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows7-x64
6Archive.zi...3e.exe
windows10-2004-x64
8Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 16:04
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
31.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
31.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20240508-en
General
-
Target
42f972925508a82236e8533567487761.exe
-
Size
3.7MB
-
MD5
9d2a888ca79e1ff3820882ea1d88d574
-
SHA1
112c38d80bf2c0d48256249bbabe906b834b1f66
-
SHA256
8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
-
SHA512
17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
-
SSDEEP
98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T
Malware Config
Extracted
babylonrat
sandyclark255.hopto.org
Extracted
warzonerat
sandyclark255.hopto.org:5200
Extracted
darkcomet
2020NOV1
sandyclark255.hopto.org:35887
DC_MUTEX-6XT818D
-
InstallPath
excelsl.exe
-
gencode
n7asq0Dbu7D2
-
install
true
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
true
-
reg_key
office
Extracted
asyncrat
0.5.6A
sandyclark255.hopto.org:6606
sandyclark255.hopto.org:8808
sandyclark255.hopto.org:7707
adweqsds56332
-
delay
5
-
install
true
-
install_file
prndrvest.exe
-
install_folder
%AppData%
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
QyDSW8NVl3ePpAfR.exesvuhost.exesvbhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\7ZzzdrRqOCBz.exe\",explorer.exe" QyDSW8NVl3ePpAfR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe" svuhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\oRMWLmxDxIiZ.exe\",explorer.exe" svbhost.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral16/memory/4860-195-0x0000000005050000-0x0000000005062000-memory.dmp family_asyncrat behavioral16/memory/2812-255-0x0000000005AA0000-0x0000000005AB2000-memory.dmp family_asyncrat -
Warzone RAT payload 2 IoCs
Processes:
resource yara_rule behavioral16/memory/4460-107-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral16/memory/4460-111-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Disables RegEdit via registry modification 1 IoCs
Processes:
svuhost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" svuhost.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svuhost.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svuhost.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3852 netsh.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
42f972925508a82236e8533567487761.exesvuhost.exeDonKdq8BWj8daM41.exeoBXgVKAbRuKoSQ4A.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation 42f972925508a82236e8533567487761.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation svuhost.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation DonKdq8BWj8daM41.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation oBXgVKAbRuKoSQ4A.exe -
Drops startup file 2 IoCs
Processes:
svehosts.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe svehosts.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe svehosts.exe -
Executes dropped EXE 21 IoCs
Processes:
DonKdq8BWj8daM41.exeQyDSW8NVl3ePpAfR.exeGOgeIF51dah78xBn.exeoBXgVKAbRuKoSQ4A.exevkFkwTHl4aZC3Krr.exeZ33KiU5j5gmh3zfr.exesvthost.exesvthost.exesvthost.exesvthost.exesvbhost.exeeridjeht.exesvbhost.exesvrhost.exesvrhost.exesvuhost.exeexcelsl.exesvbhost.exesvehosts.exesvuhost.exeprndrvest.exepid process 1596 DonKdq8BWj8daM41.exe 2672 QyDSW8NVl3ePpAfR.exe 4200 GOgeIF51dah78xBn.exe 4860 oBXgVKAbRuKoSQ4A.exe 3524 vkFkwTHl4aZC3Krr.exe 2676 Z33KiU5j5gmh3zfr.exe 4540 svthost.exe 3228 svthost.exe 2024 svthost.exe 1196 svthost.exe 8 svbhost.exe 4460 eridjeht.exe 2556 svbhost.exe 4476 svrhost.exe 404 svrhost.exe 2536 svuhost.exe 3140 excelsl.exe 3976 svbhost.exe 3892 svehosts.exe 3480 svuhost.exe 2812 prndrvest.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svehosts.exesvuhost.exesvuhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .." svehosts.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe" svuhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe" svuhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .." svehosts.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
42f972925508a82236e8533567487761.exeQyDSW8NVl3ePpAfR.exeZ33KiU5j5gmh3zfr.exevkFkwTHl4aZC3Krr.exeGOgeIF51dah78xBn.exesvbhost.exeexcelsl.exedescription pid process target process PID 3140 set thread context of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 2672 set thread context of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2676 set thread context of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 3524 set thread context of 4476 3524 vkFkwTHl4aZC3Krr.exe svrhost.exe PID 4200 set thread context of 2536 4200 GOgeIF51dah78xBn.exe svuhost.exe PID 2556 set thread context of 3976 2556 svbhost.exe svbhost.exe PID 3140 set thread context of 3480 3140 excelsl.exe svuhost.exe -
Drops file in Windows directory 1 IoCs
Processes:
DonKdq8BWj8daM41.exedescription ioc process File created C:\Windows\svehosts.exe DonKdq8BWj8daM41.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2892 3140 WerFault.exe 42f972925508a82236e8533567487761.exe 380 2676 WerFault.exe Z33KiU5j5gmh3zfr.exe 2160 3524 WerFault.exe vkFkwTHl4aZC3Krr.exe 1308 4200 WerFault.exe GOgeIF51dah78xBn.exe 3524 3140 WerFault.exe excelsl.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1092 timeout.exe -
Modifies registry class 1 IoCs
Processes:
svuhost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svuhost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
42f972925508a82236e8533567487761.exeQyDSW8NVl3ePpAfR.exeZ33KiU5j5gmh3zfr.exevkFkwTHl4aZC3Krr.exeGOgeIF51dah78xBn.exesvbhost.exeexcelsl.exeoBXgVKAbRuKoSQ4A.exeprndrvest.exepid process 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 3140 42f972925508a82236e8533567487761.exe 2672 QyDSW8NVl3ePpAfR.exe 2672 QyDSW8NVl3ePpAfR.exe 2676 Z33KiU5j5gmh3zfr.exe 2676 Z33KiU5j5gmh3zfr.exe 2676 Z33KiU5j5gmh3zfr.exe 2676 Z33KiU5j5gmh3zfr.exe 3524 vkFkwTHl4aZC3Krr.exe 3524 vkFkwTHl4aZC3Krr.exe 3524 vkFkwTHl4aZC3Krr.exe 3524 vkFkwTHl4aZC3Krr.exe 3524 vkFkwTHl4aZC3Krr.exe 3524 vkFkwTHl4aZC3Krr.exe 3524 vkFkwTHl4aZC3Krr.exe 3524 vkFkwTHl4aZC3Krr.exe 4200 GOgeIF51dah78xBn.exe 4200 GOgeIF51dah78xBn.exe 4200 GOgeIF51dah78xBn.exe 4200 GOgeIF51dah78xBn.exe 2556 svbhost.exe 2556 svbhost.exe 3140 excelsl.exe 3140 excelsl.exe 3140 excelsl.exe 3140 excelsl.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 4860 oBXgVKAbRuKoSQ4A.exe 2812 prndrvest.exe 2812 prndrvest.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svrhost.exesvbhost.exepid process 4476 svrhost.exe 8 svbhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
42f972925508a82236e8533567487761.exeQyDSW8NVl3ePpAfR.exeZ33KiU5j5gmh3zfr.exevkFkwTHl4aZC3Krr.exeDonKdq8BWj8daM41.exesvbhost.exeGOgeIF51dah78xBn.exeoBXgVKAbRuKoSQ4A.exesvuhost.exesvbhost.exeexcelsl.exesvbhost.exesvuhost.exedescription pid process Token: SeDebugPrivilege 3140 42f972925508a82236e8533567487761.exe Token: SeDebugPrivilege 3140 42f972925508a82236e8533567487761.exe Token: SeDebugPrivilege 2672 QyDSW8NVl3ePpAfR.exe Token: SeDebugPrivilege 2672 QyDSW8NVl3ePpAfR.exe Token: SeDebugPrivilege 2676 Z33KiU5j5gmh3zfr.exe Token: SeDebugPrivilege 3524 vkFkwTHl4aZC3Krr.exe Token: SeDebugPrivilege 1596 DonKdq8BWj8daM41.exe Token: SeDebugPrivilege 1596 DonKdq8BWj8daM41.exe Token: SeShutdownPrivilege 8 svbhost.exe Token: SeDebugPrivilege 8 svbhost.exe Token: SeTcbPrivilege 8 svbhost.exe Token: SeDebugPrivilege 4200 GOgeIF51dah78xBn.exe Token: SeDebugPrivilege 4860 oBXgVKAbRuKoSQ4A.exe Token: SeIncreaseQuotaPrivilege 2536 svuhost.exe Token: SeSecurityPrivilege 2536 svuhost.exe Token: SeTakeOwnershipPrivilege 2536 svuhost.exe Token: SeLoadDriverPrivilege 2536 svuhost.exe Token: SeSystemProfilePrivilege 2536 svuhost.exe Token: SeSystemtimePrivilege 2536 svuhost.exe Token: SeProfSingleProcessPrivilege 2536 svuhost.exe Token: SeIncBasePriorityPrivilege 2536 svuhost.exe Token: SeCreatePagefilePrivilege 2536 svuhost.exe Token: SeBackupPrivilege 2536 svuhost.exe Token: SeRestorePrivilege 2536 svuhost.exe Token: SeShutdownPrivilege 2536 svuhost.exe Token: SeDebugPrivilege 2536 svuhost.exe Token: SeSystemEnvironmentPrivilege 2536 svuhost.exe Token: SeChangeNotifyPrivilege 2536 svuhost.exe Token: SeRemoteShutdownPrivilege 2536 svuhost.exe Token: SeUndockPrivilege 2536 svuhost.exe Token: SeManageVolumePrivilege 2536 svuhost.exe Token: SeImpersonatePrivilege 2536 svuhost.exe Token: SeCreateGlobalPrivilege 2536 svuhost.exe Token: 33 2536 svuhost.exe Token: 34 2536 svuhost.exe Token: 35 2536 svuhost.exe Token: 36 2536 svuhost.exe Token: SeDebugPrivilege 2556 svbhost.exe Token: SeDebugPrivilege 2556 svbhost.exe Token: SeDebugPrivilege 3140 excelsl.exe Token: SeShutdownPrivilege 3976 svbhost.exe Token: SeDebugPrivilege 3976 svbhost.exe Token: SeTcbPrivilege 3976 svbhost.exe Token: SeIncreaseQuotaPrivilege 3480 svuhost.exe Token: SeSecurityPrivilege 3480 svuhost.exe Token: SeTakeOwnershipPrivilege 3480 svuhost.exe Token: SeLoadDriverPrivilege 3480 svuhost.exe Token: SeSystemProfilePrivilege 3480 svuhost.exe Token: SeSystemtimePrivilege 3480 svuhost.exe Token: SeProfSingleProcessPrivilege 3480 svuhost.exe Token: SeIncBasePriorityPrivilege 3480 svuhost.exe Token: SeCreatePagefilePrivilege 3480 svuhost.exe Token: SeBackupPrivilege 3480 svuhost.exe Token: SeRestorePrivilege 3480 svuhost.exe Token: SeShutdownPrivilege 3480 svuhost.exe Token: SeDebugPrivilege 3480 svuhost.exe Token: SeSystemEnvironmentPrivilege 3480 svuhost.exe Token: SeChangeNotifyPrivilege 3480 svuhost.exe Token: SeRemoteShutdownPrivilege 3480 svuhost.exe Token: SeUndockPrivilege 3480 svuhost.exe Token: SeManageVolumePrivilege 3480 svuhost.exe Token: SeImpersonatePrivilege 3480 svuhost.exe Token: SeCreateGlobalPrivilege 3480 svuhost.exe Token: 33 3480 svuhost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
svbhost.exesvuhost.exepid process 8 svbhost.exe 3480 svuhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42f972925508a82236e8533567487761.exeQyDSW8NVl3ePpAfR.exeZ33KiU5j5gmh3zfr.exesvbhost.exevkFkwTHl4aZC3Krr.exedescription pid process target process PID 3140 wrote to memory of 1596 3140 42f972925508a82236e8533567487761.exe DonKdq8BWj8daM41.exe PID 3140 wrote to memory of 1596 3140 42f972925508a82236e8533567487761.exe DonKdq8BWj8daM41.exe PID 3140 wrote to memory of 1596 3140 42f972925508a82236e8533567487761.exe DonKdq8BWj8daM41.exe PID 3140 wrote to memory of 2672 3140 42f972925508a82236e8533567487761.exe QyDSW8NVl3ePpAfR.exe PID 3140 wrote to memory of 2672 3140 42f972925508a82236e8533567487761.exe QyDSW8NVl3ePpAfR.exe PID 3140 wrote to memory of 2672 3140 42f972925508a82236e8533567487761.exe QyDSW8NVl3ePpAfR.exe PID 3140 wrote to memory of 4200 3140 42f972925508a82236e8533567487761.exe GOgeIF51dah78xBn.exe PID 3140 wrote to memory of 4200 3140 42f972925508a82236e8533567487761.exe GOgeIF51dah78xBn.exe PID 3140 wrote to memory of 4200 3140 42f972925508a82236e8533567487761.exe GOgeIF51dah78xBn.exe PID 3140 wrote to memory of 4860 3140 42f972925508a82236e8533567487761.exe oBXgVKAbRuKoSQ4A.exe PID 3140 wrote to memory of 4860 3140 42f972925508a82236e8533567487761.exe oBXgVKAbRuKoSQ4A.exe PID 3140 wrote to memory of 4860 3140 42f972925508a82236e8533567487761.exe oBXgVKAbRuKoSQ4A.exe PID 3140 wrote to memory of 2676 3140 42f972925508a82236e8533567487761.exe Z33KiU5j5gmh3zfr.exe PID 3140 wrote to memory of 2676 3140 42f972925508a82236e8533567487761.exe Z33KiU5j5gmh3zfr.exe PID 3140 wrote to memory of 2676 3140 42f972925508a82236e8533567487761.exe Z33KiU5j5gmh3zfr.exe PID 3140 wrote to memory of 3524 3140 42f972925508a82236e8533567487761.exe vkFkwTHl4aZC3Krr.exe PID 3140 wrote to memory of 3524 3140 42f972925508a82236e8533567487761.exe vkFkwTHl4aZC3Krr.exe PID 3140 wrote to memory of 3524 3140 42f972925508a82236e8533567487761.exe vkFkwTHl4aZC3Krr.exe PID 3140 wrote to memory of 4540 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 4540 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 4540 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 3228 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 3228 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 3228 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 2024 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 2024 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 2024 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 3140 wrote to memory of 1196 3140 42f972925508a82236e8533567487761.exe svthost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2672 wrote to memory of 8 2672 QyDSW8NVl3ePpAfR.exe svbhost.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 2676 wrote to memory of 4460 2676 Z33KiU5j5gmh3zfr.exe eridjeht.exe PID 8 wrote to memory of 2556 8 svbhost.exe svbhost.exe PID 8 wrote to memory of 2556 8 svbhost.exe svbhost.exe PID 8 wrote to memory of 2556 8 svbhost.exe svbhost.exe PID 3524 wrote to memory of 404 3524 vkFkwTHl4aZC3Krr.exe svrhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DonKdq8BWj8daM41.exe"C:\Users\Admin\AppData\Local\Temp\DonKdq8BWj8daM41.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\svehosts.exe"C:\Windows\svehosts.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Users\Admin\AppData\Local\Temp\QyDSW8NVl3ePpAfR.exe"C:\Users\Admin\AppData\Local\Temp\QyDSW8NVl3ePpAfR.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 84⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\GOgeIF51dah78xBn.exe"C:\Users\Admin\AppData\Local\Temp\GOgeIF51dah78xBn.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"3⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
-
C:\Users\Admin\Documents\excelsl.exe"C:\Users\Admin\Documents\excelsl.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exenotepad6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 11405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 11483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\oBXgVKAbRuKoSQ4A.exe"C:\Users\Admin\AppData\Local\Temp\oBXgVKAbRuKoSQ4A.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp79CF.tmp.bat""3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\prndrvest.exe"C:\Users\Admin\AppData\Roaming\prndrvest.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Z33KiU5j5gmh3zfr.exe"C:\Users\Admin\AppData\Local\Temp\Z33KiU5j5gmh3zfr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 11603⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\vkFkwTHl4aZC3Krr.exe"C:\Users\Admin\AppData\Local\Temp\vkFkwTHl4aZC3Krr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 11523⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 16282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2676 -ip 26761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4200 -ip 42001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3140 -ip 31401⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\excelsl.exe.logFilesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exeFilesize
3.7MB
MD59d2a888ca79e1ff3820882ea1d88d574
SHA1112c38d80bf2c0d48256249bbabe906b834b1f66
SHA2568b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA51217a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
-
C:\Users\Admin\AppData\Local\Temp\DonKdq8BWj8daM41.exeFilesize
472KB
MD52819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Users\Admin\AppData\Local\Temp\GOgeIF51dah78xBn.exeFilesize
742KB
MD53e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\QyDSW8NVl3ePpAfR.exeFilesize
801KB
MD59133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\Z33KiU5j5gmh3zfr.exeFilesize
366KB
MD5f07d2c33e4afe36ec6f6f14f9a56e84a
SHA13ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2
-
C:\Users\Admin\AppData\Local\Temp\oBXgVKAbRuKoSQ4A.exeFilesize
376KB
MD5590acb5fa6b5c3001ebce3d67242aac4
SHA15df39906dc4e60f01b95783fc55af6128402d611
SHA2567bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA5124ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba
-
C:\Users\Admin\AppData\Local\Temp\tmp79CF.tmp.batFilesize
153B
MD514618446405a6abc2e7e885d063b844f
SHA129e2c6654aac9f76e1c7b92a91d4623f9817ee4a
SHA256b2a71834247dbeaa2229ae9f09fcbb583418fcfae8373d4f60f3ec4d2e56e3d1
SHA512329d154c43a9350faacff8c1a8519b42e1bd706c07c89a990c112497c7eb95880e242f35d459ec5300531f55d68db160a09418f695325e5868dc07186c68eb9b
-
C:\Users\Admin\AppData\Local\Temp\vkFkwTHl4aZC3Krr.exeFilesize
336KB
MD5e87459f61fd1f017d4bd6b0a1a1fc86a
SHA130838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeFilesize
41.4MB
MD5df21fe1cbcecafe376d33476601b264d
SHA1af1dee5dc588acc7e835aaccb8ef86079e7f24d1
SHA25678df9394bfee605531e5e9b17471a169645d72b693d0e55075b210650ee329e0
SHA5125a53d85a8f04eb047676db2c1c82a0ba34cc187836c16a08478777f0d14faaa2e4997d0697b7eba446c2e12c67f36c320dfcc8588cde503ff3f2a45f50360589
-
memory/8-98-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-115-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-200-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-113-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-116-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-112-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-108-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-103-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-101-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/8-234-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1196-88-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1528-138-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/1596-221-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/1596-35-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/1596-36-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/2536-131-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2536-128-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2536-133-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2672-60-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/2672-247-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/2672-67-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/2812-255-0x0000000005AA0000-0x0000000005AB2000-memory.dmpFilesize
72KB
-
memory/3140-27-0x00000000747C2000-0x00000000747C3000-memory.dmpFilesize
4KB
-
memory/3140-0-0x00000000747C2000-0x00000000747C3000-memory.dmpFilesize
4KB
-
memory/3140-1-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/3140-75-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/3140-3-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/3140-93-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/3140-2-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/3480-228-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3480-230-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3480-231-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3480-226-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3976-207-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/4168-229-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/4200-196-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/4200-81-0x00000000747C0000-0x0000000074D71000-memory.dmpFilesize
5.7MB
-
memory/4460-111-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/4460-107-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/4476-123-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4476-121-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4860-91-0x00000000098F0000-0x0000000009914000-memory.dmpFilesize
144KB
-
memory/4860-233-0x0000000009A10000-0x0000000009A76000-memory.dmpFilesize
408KB
-
memory/4860-84-0x0000000005C40000-0x00000000061E4000-memory.dmpFilesize
5.6MB
-
memory/4860-236-0x0000000009D30000-0x0000000009DCC000-memory.dmpFilesize
624KB
-
memory/4860-87-0x0000000005730000-0x00000000057C2000-memory.dmpFilesize
584KB
-
memory/4860-90-0x0000000005700000-0x000000000570A000-memory.dmpFilesize
40KB
-
memory/4860-83-0x0000000000E10000-0x0000000000E74000-memory.dmpFilesize
400KB
-
memory/4860-195-0x0000000005050000-0x0000000005062000-memory.dmpFilesize
72KB