Malware Analysis Report

2025-06-15 21:03

Sample ID 221218-j22y2sba99
Target 804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e
SHA256 804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e
Tags
danabot banker discovery persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e

Threat Level: Known bad

The file 804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e was found to be: Known bad.

Malicious Activity Summary

danabot banker discovery persistence trojan

Danabot

Blocklisted process makes network request

Sets DLL path for service in the registry

Sets service image path in registry

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-12-18 08:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-12-18 08:10

Reported

2022-12-18 08:13

Platform

win10-20220812-en

Max time kernel

133s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\back-arrow-disabled\Parameters\ServiceDll = "C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\back-arrow-disabled.dll" C:\Windows\SysWOW64\rundll32.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\back-arrow-disabled\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4772 set thread context of 8 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\fillandsign.svg C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIB.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef.pak C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\back-arrow-disabled.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\br.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\createpdf.svg C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\AcroTextExtractor.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\AXSLE.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\RTC.der C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\DataMatrix.pmp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\createpdf.svg C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXSLE.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\aic_file_icons_retina_thumb.png C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\BIB.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\index.html C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\fillandsign.svg C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Certificates_R.aapp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\ended_review_or_form.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\eula.ini C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\ended_review_or_form.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\form_responses.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Close.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\eula.ini C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000092556549100054656d7000003a0009000400efbe0c554b88925565492e0000000000000000000000000000000000000000000000000001340001540065006d007000000014000000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\system32\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e.exe

"C:\Users\Admin\AppData\Local\Temp\804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20185

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\reference assemblies\microsoft\back-arrow-disabled.dll",alQWV1VWWVhB

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 127.0.0.1:20185 tcp
N/A 127.0.0.1:1312 tcp
N/A 20.42.72.131:443 tcp
N/A 8.238.20.254:80 tcp
N/A 23.236.181.126:443 tcp
N/A 127.0.0.1:20185 tcp
N/A 97.172.27.120:443 tcp

Files

memory/2772-116-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-117-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-141-0x0000000000C00000-0x0000000000E51000-memory.dmp

memory/2772-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-143-0x0000000002700000-0x0000000002A85000-memory.dmp

memory/2772-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-161-0x0000000000400000-0x0000000000791000-memory.dmp

memory/2772-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-168-0x0000000000000000-mapping.dmp

memory/4772-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-173-0x0000000002700000-0x0000000002A85000-memory.dmp

memory/2772-175-0x0000000000400000-0x0000000000791000-memory.dmp

memory/4772-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/2772-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-185-0x00000000779B0000-0x0000000077B3E000-memory.dmp

memory/4772-186-0x00000000779B0000-0x0000000077B3E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 f992a7aac67173cafc435fdc7aabf080
SHA1 71d9f2987a524bd201954dd4d8d616835be693e3
SHA256 3e0cc5b098e28808a98128f7b1453cef51525572bd3fde5966de562735d03419
SHA512 170d1b62160bed7e8a40a2023eda1e5ad1fb823c3ea54c7d66cbd218f0dfdcf4723ede20908ac06684478430a99f1ea538775b11303b56dcee2a3dc7c664216e

\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 f992a7aac67173cafc435fdc7aabf080
SHA1 71d9f2987a524bd201954dd4d8d616835be693e3
SHA256 3e0cc5b098e28808a98128f7b1453cef51525572bd3fde5966de562735d03419
SHA512 170d1b62160bed7e8a40a2023eda1e5ad1fb823c3ea54c7d66cbd218f0dfdcf4723ede20908ac06684478430a99f1ea538775b11303b56dcee2a3dc7c664216e

\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

MD5 f992a7aac67173cafc435fdc7aabf080
SHA1 71d9f2987a524bd201954dd4d8d616835be693e3
SHA256 3e0cc5b098e28808a98128f7b1453cef51525572bd3fde5966de562735d03419
SHA512 170d1b62160bed7e8a40a2023eda1e5ad1fb823c3ea54c7d66cbd218f0dfdcf4723ede20908ac06684478430a99f1ea538775b11303b56dcee2a3dc7c664216e

memory/4772-225-0x0000000000C30000-0x0000000000EA1000-memory.dmp

memory/4772-260-0x0000000000C30000-0x0000000000EA1000-memory.dmp

memory/4772-277-0x0000000005390000-0x0000000005AB5000-memory.dmp

memory/8-286-0x00007FF6ED485FD0-mapping.dmp

memory/8-291-0x00000000006E0000-0x00000000008F9000-memory.dmp

memory/8-292-0x0000025407A10000-0x0000025407C3A000-memory.dmp

memory/4772-293-0x0000000005390000-0x0000000005AB5000-memory.dmp

\??\c:\program files (x86)\reference assemblies\microsoft\back-arrow-disabled.dll

MD5 c23de9d8e58de32582a872129418b786
SHA1 80e1a6a112a6fe675857fae3df1b5167d0b8b06a
SHA256 24c046c0d228d7594df2d76d5f122b4444f9e846ba41ce20f33f2746b60e17c3
SHA512 e220bd74b5361a0c1b6c3665d0599a31e4cd88580757456cd50b8b0a55383e86e050cecf99321a85cad78257d78ed98e9114f8fa7536c53487f57396f7d1e995

\Program Files (x86)\Reference Assemblies\Microsoft\back-arrow-disabled.dll

MD5 c23de9d8e58de32582a872129418b786
SHA1 80e1a6a112a6fe675857fae3df1b5167d0b8b06a
SHA256 24c046c0d228d7594df2d76d5f122b4444f9e846ba41ce20f33f2746b60e17c3
SHA512 e220bd74b5361a0c1b6c3665d0599a31e4cd88580757456cd50b8b0a55383e86e050cecf99321a85cad78257d78ed98e9114f8fa7536c53487f57396f7d1e995

\Program Files (x86)\Reference Assemblies\Microsoft\back-arrow-disabled.dll

MD5 c23de9d8e58de32582a872129418b786
SHA1 80e1a6a112a6fe675857fae3df1b5167d0b8b06a
SHA256 24c046c0d228d7594df2d76d5f122b4444f9e846ba41ce20f33f2746b60e17c3
SHA512 e220bd74b5361a0c1b6c3665d0599a31e4cd88580757456cd50b8b0a55383e86e050cecf99321a85cad78257d78ed98e9114f8fa7536c53487f57396f7d1e995

memory/5080-357-0x0000000003300000-0x0000000003571000-memory.dmp

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\resource.xml

MD5 6097c7d404561758417639b12d27baf9
SHA1 21d00beeae632bd9e507c9fa76d64ebfc72d4618
SHA256 df08eac8ede4a75785dcee3fc0819d22e2f9b6af07b2fe42149401aaa788f1d4
SHA512 b4716a20095942973f2ac292acf8693d6a68fdb96317438f057039a31d19de1030622b092b0f02b61a409a5b6581baf7506cd4c58f79c4c36cf01abc131cc3db

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Daowpeywwstdp.tmp

MD5 4cf8a5fb87b07d45e9dadccbcc20e741
SHA1 906bb9cd683531efb951800f5688306f518fb5ff
SHA256 f928068d51209a8d492fd3f5483d5ebaa240ac18af4ea58423acab1aca30d399
SHA512 801c09ed9f64ff5b0be9670f2cb822c22e086152efc079429462168dc14836052956769e809150ab946ede1913ce4343303c89d8d9db8280e0f1500f171adcb7

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\100__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml

MD5 865d649c74b05aae53850125d6c23b41
SHA1 2b4ab47d5eee5a74cfb70f8231502d97dd2d97e6
SHA256 547242ffdf9a49692c655c9af71b90a815a20a78f4121538552bd73e05eeb978
SHA512 7fd6ac21920c68848517573d4048171ee7948aa87e682c71c01ff4e96c099b2d1166df8c4f0ae3dde738b96b6dba67cf66b3cc913588bcf28cee3908e2a9b5a8

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\customizations.xml

MD5 494911cc95a519e8870e4bb8e09f0ead
SHA1 28a2112f7102f51b75cc927f2b39c9cae68b717b
SHA256 c65e5536fe94e32553a7ac15969f679c0950d85840103e04f1886e436e2b053c
SHA512 b3b1433c71b3dd4825a0c62c1428a4c528f70014512169ef06eb207a3c20ecf80b6b627b52e50716a90c94f0f6695300497eb0b3fca13997663c35e49753ade2

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\6ad6114fddb5b38e8504b0183a428c4b_16efa387-a50f-4c14-af28-bdcb77494366

MD5 a7a381aa22cc03afaf1817419a76f4aa
SHA1 f73115fd60cc4a5f51ec3563c340fe48cd455e50
SHA256 da7cc077beb57aa89904af9b7f3b6a501cd4826216fdd377af72f13e74e75552
SHA512 4aea6ea9b528e8a7ae8a61e73715806dd4d81299256d5e450d69cc16c7f5017f0d3a7f151798b5f0320b77c3ec9199e71d8d25714e8f86ccd55537b8e4a05e7b

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\128__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml

MD5 acc1cdd85db5e94b98bdbf55e2df877a
SHA1 cbd2b8777c65dbc039f5048024bac42e29e8202c
SHA256 3388bb0959f8f8c1c9d1ce2a9a4a8f7a762c6546c7141cc24e558dafd9205f33
SHA512 cb304a8bec037e9061ec6623af02e4ba701fa035c54a75bde608c3b9f0e61b5cde1931d26cf4ce8a4e88593c4d67c9259e713dff1b74bacde49045fcc4bf5ae0

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\133__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml

MD5 2e6bc0bb92d72bb64372bf703942c24e
SHA1 d59d856f0f76d02e3d0f2dc96ee1174d2b7e87ea
SHA256 1a5de55d12383de8fcaeacfbc5d6e1b7f3ff71e8b4382263324e41b70a201fac
SHA512 c747f79f6e4093759ca0b08be25d9682df7e5e1fbbc5def834cc08614fe929fc9f9bac1ed07c71427836e0e9865962ce76aeb29875370d7cedc86bf2af18396c

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml

MD5 2dd9bafcbda61d5d509e48086cd0a986
SHA1 821e66af11451535cdc249ec1493e5bca4d2cad2
SHA256 2da208b3e33831803c1b830244636ca3d6cbc54fdd7e4add03059795c169002e
SHA512 6f79656269570b309a5697b007245dff4983e6c20b9c3857ba1cc088ad4f7aec3b465e5fafc4f97b584cca88f6984ef90bbbdc499c20440f0f15da04ea79d528

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\msoutilstat.etw.man

MD5 c1e8b625377c75454266f9d172d2f77d
SHA1 68ee3ac1b685d68bfdc434f430b6158a98073807
SHA256 7847e5ba06ca0a834454a3c62ec343dcaa4339e6ef2ed5bd42e460ade5331628
SHA512 1f04e28609f08a8616c7d1ebecfa6949f1eb939b29386365e72d4263dfd13fe81d036c8f9fce41f18b1e008f47b76c7278a00a770542411f751641fe7d756d21

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\148__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml

MD5 20eb056633ed3c2eb2af5e2c5054a8a4
SHA1 7224188699892b93b3279079730cdee7f68a2e47
SHA256 c131acc27ce65721d37af2124d77f8504d14a1fa3d6777621c19c5102134d564
SHA512 0e2d24ede949fa21ce0778971b94fc5a18f4dd85af530542eb7f6b792e06604cc9215c03d080078fe4800c0e6a734f0e9ba9391cb39de3d2c30d5fc584dd2797

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\overlay.png

MD5 1f93b502e78190a2f496c2d9558e069d
SHA1 6ae6249493d36682270c0d5e3eb3c472fdd2766e
SHA256 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
SHA512 cf07724c203a82c9f202d53f63ea00ab0df2f97484bd3b9abe1a001f2e531f505ddd4ff8f2d5a2769dd9d2d60e9c1d03dd3ab5143542688f944cfd35c6f1cdf3

C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\print_property.ico

MD5 30d7062e069bc0a9b34f4034090c1aae
SHA1 e5fcedd8e4cc0463c0bc6912b1791f2876e28a61
SHA256 24e77f244b0743e311b0fc97f06513a0cecf6560e92f9c6f164288a152d32000
SHA512 85dd6c916d48804a24dbbad0f4b4842453ac31a692905f8f2f34112eaa1bbf062a825d45ed5d800bbc4663a28b0b5003ebd5fa54991cf846f1028e929ea06de6

memory/5080-391-0x0000000003D80000-0x00000000044A5000-memory.dmp

memory/4896-409-0x0000000000000000-mapping.dmp

memory/2208-427-0x0000000000000000-mapping.dmp