Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
PRTService.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_prtservice.exe_9a52ed83f9a038e8d5d8a8b157025a4bf964059_00000000_170c17b5\Report.wer
|
Little-endian UTF-16 Unicode text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC2.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE60.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\1d7a2c72-3aee-4299-91f8-2280595a512b\AgileDotNetRT.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\PRTService.exe
|
'C:\Users\user\Desktop\PRTService.exe'
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
dw20.exe -x -s 852
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
AmiHivePermissionsCorrect
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
AmiHiveOwnerCorrect
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
ProgramId
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
FileId
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
LowerCaseLongPath
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
LongPathHash
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
Name
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
Publisher
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
Version
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
BinFileVersion
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
BinaryType
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
ProductName
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
ProductVersion
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
LinkDate
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
BinProductVersion
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
Size
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
Language
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
IsPeFile
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
IsOsComponent
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
DeviceTicket
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
DeviceId
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
ApplicationFlags
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
|
001800062C4102CA
|
|
There are 13 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7FF574296000
|
unkown
|
page readonly
|
|
|
|
1A1A000
|
unkown
|
page execute and read and write
|
|
|
|
5A60000
|
unkown
|
page read and write
|
|
|
|
5C60000
|
heap private
|
page read and write
|
|
|
|
7FF574228000
|
unkown
|
page readonly
|
|
|
|
EC0000
|
unkown image
|
page readonly
|
|
|
|
EC0000
|
unkown image
|
page readonly
|
|
|
|
513AC7F000
|
unkown
|
page read and write
|
|
|
|
22521F00000
|
heap default
|
page read and write
|
|
|
|
7FF57409F000
|
unkown
|
page readonly
|
|
|
|
1A12000
|
unkown
|
page execute and read and write
|
|
|
|
1470000
|
unkown
|
page read and write
|
|
|
|
15BB000
|
heap default
|
page read and write
|
|
|
|
13A0000
|
unkown
|
page readonly
|
|
|
|
513A9FB000
|
unkown
|
page read and write
|
|
|
|
561E000
|
unkown
|
page read and write
|
|
|
|
7FF5742A5000
|
unkown
|
page readonly
|
|
|
|
6E486000
|
unkown image
|
page readonly
|
|
|
|
7FF574269000
|
unkown
|
page readonly
|
|
|
|
22521EA0000
|
heap private
|
page read and write
|
|
|
|
22521F10000
|
unkown
|
page readonly
|
|
|
|
22522A00000
|
unkown
|
page readonly
|
|
|
|
5740000
|
unkown
|
page execute and read and write
|
|
|
|
7FF574319000
|
unkown
|
page readonly
|
|
|
|
10C1000
|
unkown
|
page read and write
|
|
|
|
22522108000
|
unkown
|
page read and write
|
|
|
|
1A30000
|
heap private
|
page read and write
|
|
|
|
5D60000
|
heap private
|
page execute and read and write
|
|
|
|
513A59E000
|
unkown
|
page read and write
|
|
|
|
158A000
|
heap default
|
page read and write
|
|
|
|
1530000
|
unkown
|
page readonly
|
|
|
|
6E488000
|
unkown image
|
page execute and write copy
|
|
|
|
578B000
|
unkown
|
page readonly
|
|
|
|
1570000
|
heap private
|
page execute and read and write
|
|
|
|
7FF574226000
|
unkown
|
page readonly
|
|
|
|
15D4000
|
heap default
|
page read and write
|
|
|
|
7FF574311000
|
unkown
|
page readonly
|
|
|
|
14BE000
|
unkown
|
page read and write
|
|
|
|
7FF5742B0000
|
unkown
|
page readonly
|
|
|
|
6E481000
|
unkown image
|
page readonly
|
|
|
|
7FF57430E000
|
unkown
|
page readonly
|
|
|
|
7FF573F6D000
|
unkown
|
page readonly
|
|
|
|
5760000
|
unkown
|
page readonly
|
|
|
|
22522660000
|
unkown
|
page read and write
|
|
|
|
EF8000
|
unkown image
|
page readonly
|
|
|
|
1580000
|
heap default
|
page read and write
|
|
|
|
7FF57423A000
|
unkown
|
page readonly
|
|
|
|
1A40000
|
unkown
|
page readonly
|
|
|
|
10CA000
|
unkown
|
page read and write
|
|
|
|
513A49B000
|
unkown
|
page read and write
|
|
|
|
14C0000
|
heap private
|
page read and write
|
|
|
|
152E000
|
unkown
|
page read and write
|
|
|
|
5B80000
|
unkown
|
page read and write
|
|
|
|
22522200000
|
unkown
|
page readonly
|
|
|
|
7FF574157000
|
unkown
|
page readonly
|
|
|
|
7FF5742B7000
|
unkown
|
page readonly
|
|
|
|
3070000
|
unkown
|
page read and write
|
|
|
|
7FF574286000
|
unkown
|
page readonly
|
|
|
|
22522000000
|
unkown
|
page read and write
|
|
|
|
7FF57428C000
|
unkown
|
page readonly
|
|
|
|
32A0000
|
unkown
|
page readonly
|
|
|
|
22522056000
|
unkown
|
page read and write
|
|
|
|
5750000
|
unkown
|
page readonly
|
|
|
|
1A22000
|
unkown
|
page execute and read and write
|
|
|
|
7FF57418C000
|
unkown
|
page readonly
|
|
|
|
6E487000
|
unkown image
|
page execute and read and write
|
|
|
|
14E0000
|
heap default
|
page read and write
|
|
|
|
5B70000
|
unkown
|
page readonly
|
|
|
|
7FF5740EA000
|
unkown
|
page readonly
|
|
|
|
5A5F000
|
unkown
|
page read and write
|
|
|
|
7FF574108000
|
unkown
|
page readonly
|
|
|
|
10D0000
|
unkown
|
page read and write
|
|
|
|
225226B0000
|
unkown
|
page readonly
|
|
|
|
6E460000
|
unkown image
|
page readonly
|
|
|
|
EC2000
|
unkown image
|
page readonly
|
|
|
|
14D0000
|
unkown
|
page readonly
|
|
|
|
22522100000
|
unkown
|
page read and write
|
|
|
|
22522081000
|
unkown
|
page read and write
|
|
|
|
2252204B000
|
unkown
|
page read and write
|
|
|
|
6E483000
|
unkown image
|
page read and write
|
|
|
|
7FF57427D000
|
unkown
|
page readonly
|
|
|
|
10CD000
|
unkown
|
page read and write
|
|
|
|
57B0000
|
unkown
|
page readonly
|
|
|
|
2252203C000
|
unkown
|
page read and write
|
|
|
|
7FF574123000
|
unkown
|
page readonly
|
|
|
|
22522802000
|
unkown
|
page read and write
|
|
|
|
7FF574212000
|
unkown
|
page readonly
|
|
|
|
2252208E000
|
unkown
|
page read and write
|
|
|
|
7FF57412D000
|
unkown
|
page readonly
|
|
|
|
187F000
|
unkown
|
page read and write
|
|
|
|
571E000
|
unkown
|
page read and write
|
|
|
|
123C000
|
unkown
|
page read and write
|
|
|
|
7FF57424E000
|
unkown
|
page readonly
|
|
|
|
6E460000
|
unkown image
|
page readonly
|
|
|
|
513A51E000
|
unkown
|
page read and write
|
|
|
|
7FF57425F000
|
unkown
|
page readonly
|
|
|
|
22522051000
|
unkown
|
page read and write
|
|
|
|
1A2C000
|
unkown
|
page execute and read and write
|
|
|
|
6E485000
|
unkown image
|
page write copy
|
|
|
|
1A2A000
|
unkown
|
page execute and read and write
|
|
|
|
5910000
|
unkown
|
page readonly
|
|
|
|
7FF573E20000
|
unkown
|
page readonly
|
|
|
|
22521FF0000
|
unkown
|
page readonly
|
|
|
|
513AD7F000
|
unkown
|
page read and write
|
|
|
|
3195000
|
heap private
|
page read and write
|
|
|
|
3190000
|
heap private
|
page read and write
|
|
|
|
5750000
|
unkown
|
page read and write
|
|
|
|
513AA7E000
|
unkown
|
page read and write
|
|
|
|
595E000
|
unkown
|
page read and write
|
|
|
|
22521FE0000
|
unkown
|
page readonly
|
|
|
|
307B000
|
unkown
|
page execute and read and write
|
|
|
|
576C000
|
unkown
|
page readonly
|
|
|
|
2252204E000
|
unkown
|
page read and write
|
|
|
|
5810000
|
unkown
|
page readonly
|
|
|
|
7FF574255000
|
unkown
|
page readonly
|
|
|
|
3062000
|
unkown
|
page execute and read and write
|
|
|
|
177E000
|
unkown
|
page read and write
|
|
|
|
1560000
|
unkown
|
page read and write
|
|
|
|
5767000
|
unkown
|
page readonly
|
|
|
|
7FF573E0A000
|
unkown
|
page readonly
|
|
|
|
7FF5742B4000
|
unkown
|
page readonly
|
|
|
|
22522029000
|
unkown
|
page read and write
|
|
|
|
EC2000
|
unkown image
|
page readonly
|
|
|
|
7FF57429C000
|
unkown
|
page readonly
|
|
|
|
22522046000
|
unkown
|
page read and write
|
|
|
|
3170000
|
unkown
|
page read and write
|
|
|
|
6E471000
|
unkown image
|
page execute read
|
|
|
|
30BE000
|
unkown
|
page read and write
|
|
|
|
3180000
|
unkown
|
page readonly
|
|
|
|
22522013000
|
unkown
|
page read and write
|
|
|
|
7FF573E10000
|
unkown
|
page readonly
|
|
|
|
5730000
|
unkown
|
page read and write
|
|
|
|
22522113000
|
unkown
|
page read and write
|
|
|
|
7FF574151000
|
unkown
|
page readonly
|
|
|
|
10BD000
|
unkown
|
page read and write
|
|
|
|
7FF574319000
|
unkown
|
page readonly
|
|
|
|
3077000
|
unkown
|
page execute and read and write
|
|
|
|
329F000
|
unkown
|
page read and write
|
|
|
|
7FF574210000
|
unkown
|
page readonly
|
|
|
|
35E1000
|
unkown
|
page read and write
|
|
|
|
5B60000
|
unkown
|
page read and write
|
|
|
|
5900000
|
unkown
|
page execute and read and write
|
|
|
|
15E2000
|
heap default
|
page read and write
|
|
|
|
45E1000
|
unkown
|
page read and write
|
|
|
|
22522070000
|
unkown
|
page read and write
|
|
|
|
EF8000
|
unkown image
|
page readonly
|
|
|
|
7FF5740DE000
|
unkown
|
page readonly
|
|
|
|
513AB77000
|
unkown
|
page read and write
|
|
|
|
7FF574222000
|
unkown
|
page readonly
|
|
|
|
EC0000
|
unkown image
|
page readonly
|
|
|
|
5720000
|
unkown
|
page readonly
|
|
|
|
7FF57403A000
|
unkown
|
page readonly
|
|
|
|
1540000
|
unkown
|
page read and write
|
|
|
|
22522102000
|
unkown
|
page read and write
|
|
|
|
1336000
|
unkown
|
page read and write
|
|
There are 145 hidden memdumps, click here to show them.