Malware Analysis Report

2025-05-28 14:51

Sample ID 221219-k6q8saef64
Target 52939ddac663150e902b58fdbb2d7b75.exe
SHA256 73c4486426a8ae3962e83259140d771c80532da079c3da94965039f9d9b8b11a
Tags
danabot banker discovery trojan collection persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

73c4486426a8ae3962e83259140d771c80532da079c3da94965039f9d9b8b11a

Threat Level: Known bad

The file 52939ddac663150e902b58fdbb2d7b75.exe was found to be: Known bad.

Malicious Activity Summary

danabot banker discovery trojan collection persistence spyware stealer

Danabot

Sets service image path in registry

Sets DLL path for service in the registry

Blocklisted process makes network request

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses Microsoft Outlook accounts

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Modifies system certificate store

outlook_win_path

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-12-19 09:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-12-19 09:13

Reported

2022-12-19 09:15

Platform

win7-20221111-en

Max time kernel

126s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1708 set thread context of 1524 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\Identity-V C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\RTC.der C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\DefaultID.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\stop_collection_data.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\EQNEDT32.EXE C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\DWTRIG20.EXE C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\warning.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\EQNEDT32.HLP C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.HLP C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\ENUtxt.pdf C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\ZX______.PFB C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\ROMANIAN.TXT C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\tl.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\zy______.pfm C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\EEINTL.DLL C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\PDDom.api C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\CGMIMP32.FLT C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\MCIMPP.mpp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\forms_distributed.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\MyriadPro-It.otf C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\brt.fca C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Media Player\en-US\AdobeXMP.dll C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 912 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 912 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 912 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 912 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 912 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 912 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 912 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 1708 wrote to memory of 1524 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1708 wrote to memory of 1524 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1708 wrote to memory of 1524 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1708 wrote to memory of 1524 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1708 wrote to memory of 1524 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe

"C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23998

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows media player\en-us\defaultid.dll",DAwAVg==

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 127.0.0.1:23998 tcp
N/A 127.0.0.1:1312 tcp
N/A 23.236.181.126:443 tcp
N/A 88.70.195.99:443 tcp
N/A 127.0.0.1:23998 tcp

Files

memory/912-54-0x0000000001E00000-0x0000000001ED6000-memory.dmp

memory/912-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

memory/1708-56-0x0000000000000000-mapping.dmp

memory/912-57-0x0000000001E00000-0x0000000001ED6000-memory.dmp

memory/912-58-0x0000000001F30000-0x0000000002045000-memory.dmp

memory/912-60-0x0000000000400000-0x0000000000517000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

memory/1708-63-0x00000000042F0000-0x0000000004A15000-memory.dmp

memory/1708-65-0x00000000042F0000-0x0000000004A15000-memory.dmp

memory/1708-67-0x0000000004A20000-0x0000000004B60000-memory.dmp

memory/1708-66-0x00000000042F0000-0x0000000004A15000-memory.dmp

memory/1708-68-0x0000000004A20000-0x0000000004B60000-memory.dmp

memory/1708-69-0x0000000004C00000-0x0000000004D40000-memory.dmp

memory/1524-70-0x0000000000280000-0x0000000000499000-memory.dmp

memory/1708-72-0x0000000004C00000-0x0000000004D40000-memory.dmp

memory/1708-73-0x0000000004A20000-0x0000000004B60000-memory.dmp

memory/1524-75-0x00000000FF8F3CEC-mapping.dmp

memory/1708-74-0x0000000004A20000-0x0000000004B60000-memory.dmp

memory/1524-77-0x0000000002140000-0x0000000002280000-memory.dmp

memory/1524-76-0x0000000002140000-0x0000000002280000-memory.dmp

memory/1524-78-0x000007FEFC191000-0x000007FEFC193000-memory.dmp

memory/1524-79-0x0000000000280000-0x0000000000499000-memory.dmp

memory/1524-80-0x0000000001F10000-0x000000000213A000-memory.dmp

memory/1708-81-0x00000000042F0000-0x0000000004A15000-memory.dmp

\Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

MD5 422c43b3002290e39b743e5e2f58038c
SHA1 6c19e2c7162d44dc6d10d925917b39525a74fb58
SHA256 722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96
SHA512 d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

\??\c:\program files (x86)\windows media player\en-us\defaultid.dll

MD5 422c43b3002290e39b743e5e2f58038c
SHA1 6c19e2c7162d44dc6d10d925917b39525a74fb58
SHA256 722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96
SHA512 d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 54ff3900b621e68b4c846280fdced6d5
SHA1 537a7c4a624bb02549e5924fcd8d29550f83e2c2
SHA256 872488e53ad21946db15b272d9f750d2bc621a1ea71825c0a31848a0d7b8ba6e
SHA512 845021452f3c4fac99e57b0d1cab6d824bc804956a8c707517ddf0fad6c4e9683eb0f40977f255dcf243822c18320300544757b2ce97f7ecb14d82925c3a52ea

memory/1220-86-0x00000000039B0000-0x00000000040D5000-memory.dmp

memory/1220-88-0x00000000039B0000-0x00000000040D5000-memory.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\ENVELOPR.DLL.trx_dll

MD5 10fa6ecb335d75b17d2c3ac4f3cbaabb
SHA1 0f549eed3c20f7178f2b6f12cb8f3c0dcf022f94
SHA256 1dd89f6d6d5159abd258bf7c0126382986781bee81ad7f7da15e50f2db8e45b8
SHA512 c55f5986fb3ba8d2828d0428a8599cfc1e2b1db7263ffc4bedcc016a3ba47539534685b3dfa0edaff5a8e90a7272cac113cedb3ae672cb43a8a6c42040c1ac01

memory/1220-95-0x00000000039B0000-0x00000000040D5000-memory.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MAPIR.DLL.trx_dll

MD5 6160f8c93afc05e003587e6ca882fe45
SHA1 0254cbfac12f7d90f2ef4f6310420653c63d7e42
SHA256 229e4cbf919ed25ea98a528867d5869352d9e06cda2fdc295976be6b6987445e
SHA512 15ddd1efc78f28d8072d8eb33e8fb74500978323e8730aef035d6847748c4f70b6c156cec24d2ff40a880eb9b49248c3b04388bc74485366b923bf710b71b56b

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 b1f1b4567224861ddf5d35ea76221834
SHA1 ff62e6c22b603db53e617187c3c6fbee81f6e90a
SHA256 84e15304b2d4220243f898d30b51638a25c7bbc7ef6244ae5c4fea8e64d8b688
SHA512 25cac9eb9507fc9ba1c1e08aeec4b5a4d0ce4e7c7bc6fc464f7852c108cdd39cf628140eef78ae697adc56e150e8ab33600d4af03f591866caa245c9ca850bbc

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MSS.chk

MD5 f7a65946e752c54fc81b2b2d29e0c196
SHA1 fa3922af40e1d13a7f236dbad42f40248f610c55
SHA256 c6b709ba353d8a828ae7a35cac66b3149e3a8dbc5ad068b64e1661cd0eaddbbd
SHA512 469d33a99a86b4a8e8d9c5c2294d33a0793aada11f845eaa314cf96dfc0e87bc2faed3ce97f6b6d3a06ab4a40095b834d023fbc2e6e164db7931a4f845d8bd5d

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\ringtones.ico

MD5 8b30e7cbd25f178baac418e9b507b61e
SHA1 73c93d967571bb88b1bdf33477e7a5f758fc18e9
SHA256 0afa2eb896ffe20c5244dd191be791231c8b5b71eff200e75a3150a8e3296f30
SHA512 6b0ff7ff67cbb4c8611696273ee16fc5d57b53ea7869e0c97686583d7875faa65f04d7678017628a11420000f8bb869f6dca5fcbefb53b1824443fa73544944d

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\usertile28.bmp

MD5 48f8ed9f48d19265562803b0ee219a91
SHA1 4984fd3b8e278e92022f257ea46cb0301c72797f
SHA256 a341b43e0a07fcb987aac58646c6105c52106616f6fae3948865be5023cffddc
SHA512 9d88d507c3e88cecf2e11f2541b4e4dca2fc429b92c86b910ba1d15ad8ac3af307c3f4951429e08838e764a7819538877fa7c29ff8704cc6cab23757ec41e0e1

memory/1128-96-0x0000000000000000-mapping.dmp

\Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

MD5 422c43b3002290e39b743e5e2f58038c
SHA1 6c19e2c7162d44dc6d10d925917b39525a74fb58
SHA256 722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96
SHA512 d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

\Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

MD5 422c43b3002290e39b743e5e2f58038c
SHA1 6c19e2c7162d44dc6d10d925917b39525a74fb58
SHA256 722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96
SHA512 d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

\Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

MD5 422c43b3002290e39b743e5e2f58038c
SHA1 6c19e2c7162d44dc6d10d925917b39525a74fb58
SHA256 722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96
SHA512 d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

\Program Files (x86)\Windows Media Player\en-US\DefaultID.dll

MD5 422c43b3002290e39b743e5e2f58038c
SHA1 6c19e2c7162d44dc6d10d925917b39525a74fb58
SHA256 722a93ad29bea7383b6912da551a8995642c8636512b37e31d322a7afca81c96
SHA512 d1658ce7b013579228b01bbee4febd605366db6341cb5bfc8c6bb2c1d72cb0fb9be32c5d1f6f86915066609b63974ca771c737ea7c5ebf0b2509b7e417d394db

memory/1128-102-0x0000000003910000-0x0000000004035000-memory.dmp

memory/1128-104-0x0000000003910000-0x0000000004035000-memory.dmp

memory/1128-105-0x0000000003910000-0x0000000004035000-memory.dmp

memory/1708-106-0x0000000006130000-0x0000000006288000-memory.dmp

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

memory/320-111-0x0000000000000000-mapping.dmp

memory/1220-112-0x00000000039B0000-0x00000000040D5000-memory.dmp

memory/1128-113-0x0000000003910000-0x0000000004035000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-12-19 09:13

Reported

2022-12-19 09:15

Platform

win10v2004-20220812-en

Max time kernel

149s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AcroLayoutRecognizer\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\AcroLayoutRecognizer.dll\u0600" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AcroLayoutRecognizer\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\AcroLayoutRecognizer.dllï´€" C:\Windows\SysWOW64\rundll32.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AcroLayoutRecognizer\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService\uff00" C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\SysWOW64\rundll32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3344 set thread context of 1364 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WindowsPowerShell\Modules\ReadOutLoud.api C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\warning.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\apple-touch-icon-72x72-precomposed.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-default.svg C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\drvDX9.x3d C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\s_agreement_filetype.svg C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\forms_super.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-down.svg C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\adobe_spinner.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\init.js C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\add_reviewer.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\close_x.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\en-US.pak C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_agreement_filetype.svg C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Eula.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\turnOffNotificationInAcrobat.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\bl.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\COPYING.LGPLv2.1.txt C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\AcroLayoutRecognizer.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\email_all.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip32.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_super.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\reviews_super.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\s_filetype_xd.svg C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-default.svg C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-down.svg C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\svchost.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\999290C14ADD5D8D89BB7E418ED753C0A6F26CF9 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\999290C14ADD5D8D89BB7E418ED753C0A6F26CF9\Blob = 030000000100000014000000999290c14add5d8d89bb7e418ed753c0a6f26cf92000000001000000e9020000308202e53082024ea00302010202082ca823595939b962300d06092a864886f70d01010b05003081853145304306035504030c3c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20416d74686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3230313231393130313531385a170d3234313231383130313531385a3081853145304306035504030c3c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20416d74686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100d694f55ad022ba105c8d5c6cde838ae8e0391a51f59191fdaa71bf1b19f64386248963c0dcfdcfd51a095377402dc8f5eda7b8992a101ee6e9bdb0fad4d1f2e2759da55be5f721f9dab4d4c25d45ac9e1d55ced189bb071be209aca4a21486a4aa9c3a15cd10841c3386d98b6d2e6080496c2ca40a2f6d34e27d8831ca40257f0203010001a35c305a300f0603551d130101ff040530030101ff30470603551d110440303e823c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20416d74686f72697479202d204735300d06092a864886f70d01010b0500038181006a7e5c2b4666df2551c55894dc1b823f6692d6434337da6f2ad3365c05d21842bf909698d141391d25e51c3c4000a879fa5c1132cd7493c55014d80c49dd1feb854d7c2d0eb7e86c272f5938ad4b628529a85952e6b66a38dc450565ed1c104df968d89fee93f852c286d57d553b34fde3ef436e0077eb190f89680e512c25e8 C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4972 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 4972 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 4972 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe C:\Windows\SysWOW64\rundll32.exe
PID 3344 wrote to memory of 1364 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 3344 wrote to memory of 1364 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 3344 wrote to memory of 1364 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 3636 wrote to memory of 2100 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\rundll32.exe
PID 3636 wrote to memory of 2100 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\rundll32.exe
PID 3636 wrote to memory of 2100 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\rundll32.exe
PID 3344 wrote to memory of 2404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\schtasks.exe
PID 3344 wrote to memory of 2404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\schtasks.exe
PID 3344 wrote to memory of 2404 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\schtasks.exe
PID 3344 wrote to memory of 3136 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\schtasks.exe
PID 3344 wrote to memory of 3136 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\schtasks.exe
PID 3344 wrote to memory of 3136 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\schtasks.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe

"C:\Users\Admin\AppData\Local\Temp\52939ddac663150e902b58fdbb2d7b75.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4972 -ip 4972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 528

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23993

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\acrolayoutrecognizer.dll",hUk8TQ==

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

C:\Windows\SysWOW64\schtasks.exe

schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 93.184.220.29:80 tcp
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 127.0.0.1:23993 tcp
N/A 104.80.225.205:443 tcp
N/A 127.0.0.1:1312 tcp
N/A 93.184.221.240:80 tcp
N/A 23.236.181.126:443 tcp
N/A 127.0.0.1:23993 tcp
N/A 100.242.29.16:443 tcp
N/A 224.0.0.251:5353 udp
N/A 127.0.0.1:23990 tcp
N/A 127.0.0.1:1312 tcp
N/A 127.0.0.1:23990 tcp
N/A 127.0.0.1:23993 tcp
N/A 127.0.0.1:23990 tcp
N/A 127.0.0.1:1312 tcp
N/A 127.0.0.1:23993 tcp
N/A 127.0.0.1:23990 tcp
N/A 127.0.0.1:1312 tcp
N/A 127.0.0.1:23990 tcp
N/A 127.0.0.1:23993 tcp
N/A 127.0.0.1:1312 tcp
N/A 127.0.0.1:23990 tcp
N/A 127.0.0.1:23993 tcp

Files

memory/4972-132-0x0000000002271000-0x0000000002347000-memory.dmp

memory/4972-133-0x0000000002410000-0x0000000002525000-memory.dmp

memory/4972-134-0x0000000000400000-0x0000000000517000-memory.dmp

memory/3344-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

memory/4972-138-0x0000000000400000-0x0000000000517000-memory.dmp

memory/3344-139-0x00000000040B0000-0x00000000047D5000-memory.dmp

memory/3344-140-0x00000000040B0000-0x00000000047D5000-memory.dmp

memory/3344-141-0x00000000049D0000-0x0000000004B10000-memory.dmp

memory/3344-142-0x00000000049D0000-0x0000000004B10000-memory.dmp

memory/3344-143-0x00000000049D0000-0x0000000004B10000-memory.dmp

memory/3344-144-0x00000000049D0000-0x0000000004B10000-memory.dmp

memory/3344-145-0x00000000049D0000-0x0000000004B10000-memory.dmp

memory/3344-146-0x00000000049D0000-0x0000000004B10000-memory.dmp

memory/1364-147-0x00007FF6EA0C6890-mapping.dmp

memory/1364-148-0x00000260F4EA0000-0x00000260F4FE0000-memory.dmp

memory/1364-149-0x00000260F4EA0000-0x00000260F4FE0000-memory.dmp

memory/1364-151-0x0000000000180000-0x0000000000399000-memory.dmp

memory/3344-150-0x0000000004A49000-0x0000000004A4B000-memory.dmp

memory/1364-152-0x00000260F34D0000-0x00000260F36FA000-memory.dmp

memory/3344-153-0x00000000040B0000-0x00000000047D5000-memory.dmp

\??\c:\program files (x86)\windowspowershell\modules\acrolayoutrecognizer.dll

MD5 08e25e3cde93ea8a44a3bff913f7fa5d
SHA1 776339feba4006e79aad70e31ee7c17f375a6c2e
SHA256 46bf6620457f2b768a171b64c2847f7194d950bbfbd7a89c1a04f5d027904dca
SHA512 a7ee68f0c03013e54bbfc174fc75a50e99b2005db87d5207c960773f84f078664d50567f248618db591f8949a1ce6cd393bd78972ed46e23500f7c9cbc8cf8f5

C:\Program Files (x86)\WindowsPowerShell\Modules\AcroLayoutRecognizer.dll

MD5 08e25e3cde93ea8a44a3bff913f7fa5d
SHA1 776339feba4006e79aad70e31ee7c17f375a6c2e
SHA256 46bf6620457f2b768a171b64c2847f7194d950bbfbd7a89c1a04f5d027904dca
SHA512 a7ee68f0c03013e54bbfc174fc75a50e99b2005db87d5207c960773f84f078664d50567f248618db591f8949a1ce6cd393bd78972ed46e23500f7c9cbc8cf8f5

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 f90e7f329f23a9e4cf3e8f09725c6563
SHA1 8ed637772d70cb23ed6a3238b1edecf68688acd4
SHA256 6572e528a18e0a0f9e09ff6c61b36421c1e1d46b54a970b49161aaac5a19a2ca
SHA512 dd9d575f8f0f07c504973d2ba14a03835d85e420a2aba0357bf3a185c2b97d6ac19104b65672b2c44220ca13453dac26bb55c5d7348b6d1a692877e290f20bbe

memory/3636-157-0x0000000003810000-0x0000000003F35000-memory.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml

MD5 98de295b21abe2451f86b82df3be269a
SHA1 1665a23d307748e8c1c0164ba7939275f9fb676c
SHA256 fd3507cd60edf41093c8fe843d1601e33db9cbe1cd36247cec587c265109bcfa
SHA512 230ae283c81771496dcae9ef84787379712106738ea82754b101af9047ae27cadb8b1f4aed00d146a699c22fd1c505c31068418a70d2b535c85c3017726d91cc

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\print_queue.ico

MD5 0f3c6d90637f0fdc57b1d303cf8d76cd
SHA1 91cef4325b363b31e4555302a70321a2110b51cf
SHA256 4858a310c97817f76fd6430067ac3c0b54dc030f7547eb9fbdb082545e8cc261
SHA512 6f533242faef57f84c88ea6d5134f60f3fc8a9771a0106752d430875266698cd5d1d4beffd00abdd492d08d5f5365d905dd8869ced2ec0bc7c20be8430d73df5

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\VdiState.xml

MD5 05a593ddf82be0bb1f258c9d0585f75d
SHA1 6712a2dd452fc768e5d9f7cd3805d1592c27d676
SHA256 bf438bec47694988412b0b5d395e112ffd4376521c0cc9c523a2a8d265c3b6be
SHA512 f379ebcc30a0368757500677691d5429fc4a1876379fb83101f7183e844bed37577fcf836cbbcdd09ff696e24745fdc9aa3149c4d7ea1fdc7d9fe243d384ece4

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe.xml

MD5 996f11041df0526341cebbbd40a98390
SHA1 37f652515ef8c662840086d743f7f68d327cce52
SHA256 bb39de067132d2ccbb7a3c066743010f070a3c3856f42ccc892da0b40012771e
SHA512 6cafa4b3bd8c56d20859a4f8fb7109e3ca4c690d0746b13f9f2eaa19d88bfca469dc45d71fb91f5658f9cd300f285aafb9e212ebd7c1496aadb6046da4e56c03

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe.xml

MD5 1b8d789d46feb22b7fa9b011ac51f00f
SHA1 742b5b78b5d63450b5b5bde48ae90330f988c57e
SHA256 7c46108992cf848638182bf80bf19965f5052deed8a958804b6bdf828c167dec
SHA512 c524cac4cc8993c4f3c5d458f639314e07736bcd834179d23e929697d1c7d55b3cd1375108c2fc34133a9df3e297c1ea633e2676af9bf8e073774b4534693cf0

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\wlidsvcconfig.xml

MD5 dac03d8ae64830f85b1c1908f644df8b
SHA1 eb90bbaa87304bfab50d482ba940736a536cbac0
SHA256 ff611cc994745cf92504512e18724b54f7062e5db79fcff2d695f97f49688ad8
SHA512 9e803e6891f0fcb58e33dbb88099a418793b9312d0ad63223268a2059ed922e14b2be715d9e25ba7c9bc04f05fb084ceb14e212683778283c1bf705bc17648f0

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\telemetry.P-Eco3PTelDefault.json

MD5 b658c06c14ff523bce634e14236c9441
SHA1 aa15105fc5cbee478303c5a1d8814a88197573be
SHA256 29633ff726d1c72f895545fd97d546035e7045a046b3d2888ff0950e67b8eb82
SHA512 3326a97db218aa09814e80317c1150f8a6808e8b6aab07af27c8126688b30964cc85936940d310c1d4d6190c49eaa01ee51d598775ec8c156676bbfd53f8f4cc

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\s641033.hash

MD5 c7acd2e60202f2d2200125e05366e637
SHA1 7d5cb1dc7201337601fcec0b71491c6ef27c593f
SHA256 2621f92f43d06d28d28c0bf72909ea4da8232cdee0704e84c2b1310075f5890a
SHA512 ff5106469272c4926a1d4bc6c1ac32f9efa20974cb20747792d7fafd928da8db319b4a3972e33499f79adb57251e8f6d5065be4c15bee193ae65d74a3066bf45

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\DeploymentConfig.2.xml

MD5 3793544370ec1fddcf5ba6ae099f2538
SHA1 c784c5d8d1c496ab7ba1150782d20cba67b76321
SHA256 87975551187040cc2505a12ac285c042b8e70921a55808ecf982c7cd37df0ae2
SHA512 debdde56e6e087ff04863490223229d37828e348f7630d6c33aae1f113cce4be75f1420c593268ef5f5bd3026dccb062015781ba83dcaffa2b9bb37b55efc319

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftOffice2013Office365Win64.xml

MD5 46353bb25b4eb2e9d26a25744c716563
SHA1 a9a9c2a1260542b5246fd642425dcc2a29a098c1
SHA256 3fae1d780e8a63d73847dc38412952c238d0e3ca01a97caee718489a3d424893
SHA512 09027ff22d03712258dbd10d6fe2cafbefd90e974210b09d20008d8eb6b569915064c65a7403187b0d78e79c96838cc0bba49b089acc7c7ab790866359719197

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.osmuxmui.msi.16.en-us.xml

MD5 220ae72aa2505c9276da2056b7e34936
SHA1 6dfb0f4fd5c0d25062d3d1235fc20358560fdb89
SHA256 afc37ba57fac36ba151953b67619dbbb985f58122f4ebe07f15b312b5bdf004c
SHA512 cab8485458b9870015f037fc6c8279018bf212d36ba01181bdb90970473a4b5aaeb9708e36eb21c8e6c1301dbdca630b29c8b3a6fa82fa14fb04bc65d235debd

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\DesktopSettings2013.xml

MD5 c6b6b07071e0f8ff39f5941a3169b20c
SHA1 d77fd2513ac3cb9b8595424d1f695fce21e33d96
SHA256 f8b710777d2c0105e74ee27ee6dfc8e43ca4ff7e14b4dba390eb72dad20705bd
SHA512 167ab504d6e4c91239f8239722aba17a7f6748fb3e8ee750b2d3f3fd677e6646a8149c8b956513cb2e90722196471865591215938cea8444fdf2e5cff180fdec

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftLync2010.xml

MD5 701beb4f8c252fb3c9f5dbdc94648048
SHA1 556ba20475a502b68b7992454be6c64ab355b4ec
SHA256 620e27a3746773947ba7ceee99d2b55e4e3cfa32a9164a0185a8cb8b22a55b67
SHA512 28c76c3d5ebb75797d37965b13cb05f852e25cc3d2558c38b091b82e12b78f268d58f144a0fcac32b30d70e5897ed7c647d4e3584edd2625ba7cdf5c54826faf

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\telemetry.ASM-WindowsDefault.json.bk

MD5 fe9f7b7fd16a326e40b72f2424bb9f13
SHA1 a3f40de8864d051cec6d1561192233e3a4b54463
SHA256 3512d316332ebd399244d3fb8a0445c0d8e6be9d37d3052cdf0dc80d2bb77a0b
SHA512 86756198db0909080eb2a6a3b5eefcabaeb59aa10db0189459af59f04c2e24fca322875c045adebc3f1c597d468c9dc71d9ff6dce916b1f891b8c3e16af7c132

memory/2100-172-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\WindowsPowerShell\Modules\AcroLayoutRecognizer.dll

MD5 08e25e3cde93ea8a44a3bff913f7fa5d
SHA1 776339feba4006e79aad70e31ee7c17f375a6c2e
SHA256 46bf6620457f2b768a171b64c2847f7194d950bbfbd7a89c1a04f5d027904dca
SHA512 a7ee68f0c03013e54bbfc174fc75a50e99b2005db87d5207c960773f84f078664d50567f248618db591f8949a1ce6cd393bd78972ed46e23500f7c9cbc8cf8f5

memory/3636-174-0x0000000003810000-0x0000000003F35000-memory.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 2ba883768ef9ad3dcb079973260db20b
SHA1 937c41f24f24e836197dcabf031006714fc4bb4b
SHA256 85deac7591d4f700f9764466cfbec89e4d849fa28241fa791caa9e1c2975bd4d
SHA512 00e03eed48c746f8ae17bab97b329748483c56bf479e5dc8d7ea08fb0a4d559a06a454ae31ea6611a3fcc0662e7446d1a9e11cc0f8ac44729645d8d550dfb9f5

memory/2100-176-0x0000000004360000-0x0000000004A85000-memory.dmp

memory/2100-177-0x0000000004360000-0x0000000004A85000-memory.dmp

memory/2404-178-0x0000000000000000-mapping.dmp

memory/3136-179-0x0000000000000000-mapping.dmp

memory/3636-180-0x0000000003810000-0x0000000003F35000-memory.dmp