Malware Analysis Report

2025-05-28 14:51

Sample ID 221219-mqfs8aeg86
Target becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a
SHA256 becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a
Tags
danabot smokeloader backdoor banker discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a

Threat Level: Known bad

The file becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a was found to be: Known bad.

Malicious Activity Summary

danabot smokeloader backdoor banker discovery trojan

SmokeLoader

Danabot

Detects Smokeloader packer

Executes dropped EXE

Blocklisted process makes network request

Downloads MZ/PE file

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Modifies Internet Explorer settings

Checks SCSI registry key(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious behavior: MapViewOfSection

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-12-19 10:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-12-19 10:39

Reported

2022-12-19 10:42

Platform

win10v2004-20220901-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe"

Signatures

Danabot

trojan banker danabot

Detects Smokeloader packer

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2DB7.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4036 set thread context of 2432 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\2DB7.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 N/A N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff N/A N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000093551155100054656d7000003a0009000400efbe21550a58935517552e00000000000000000000000000000000000000000000000000092a0300540065006d007000000014000000 N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags N/A N/A
Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" N/A N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots N/A N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 N/A N/A
Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2864 wrote to memory of 2268 N/A N/A C:\Users\Admin\AppData\Local\Temp\2DB7.exe
PID 2864 wrote to memory of 2268 N/A N/A C:\Users\Admin\AppData\Local\Temp\2DB7.exe
PID 2864 wrote to memory of 2268 N/A N/A C:\Users\Admin\AppData\Local\Temp\2DB7.exe
PID 2268 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\2DB7.exe C:\Windows\SysWOW64\rundll32.exe
PID 2268 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\2DB7.exe C:\Windows\SysWOW64\rundll32.exe
PID 2268 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\2DB7.exe C:\Windows\SysWOW64\rundll32.exe
PID 4036 wrote to memory of 2432 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 4036 wrote to memory of 2432 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 4036 wrote to memory of 2432 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe

"C:\Users\Admin\AppData\Local\Temp\becc1118b9c80b25464fde5a69a8f9c43a47931f8e261ed9806c74b10c1b211a.exe"

C:\Users\Admin\AppData\Local\Temp\2DB7.exe

C:\Users\Admin\AppData\Local\Temp\2DB7.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2268 -ip 2268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 524

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23999

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\main.dll",lD5Wag==

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 209.197.3.8:80 tcp
N/A 52.109.8.86:443 tcp
N/A 8.8.8.8:53 dowe.at udp
N/A 91.195.240.101:80 dowe.at tcp
N/A 8.8.8.8:53 xisac.com udp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 209.197.3.8:80 tcp
N/A 20.189.173.5:443 tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 23.106.123.49:80 23.106.123.49 tcp
N/A 104.80.225.205:443 tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 185.95.186.58:80 xisac.com tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 127.0.0.1:23999 tcp
N/A 127.0.0.1:1312 tcp
N/A 13.107.42.16:443 tcp
N/A 23.236.181.126:443 tcp

Files

memory/2532-132-0x00000000004E9000-0x00000000004FF000-memory.dmp

memory/2532-133-0x0000000002050000-0x0000000002059000-memory.dmp

memory/2532-134-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2532-135-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2268-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2DB7.exe

MD5 bf8c7929bc3f4fad1da578dd2b73cc0d
SHA1 716a6662f38f3ebb7b2081cf620fc2bf58b4d21e
SHA256 aa123ff84c9fc24ff4fd58d0b5796b6b176976774b877efd9ec1c8263e87b08f
SHA512 afbc94473c1518114649de98a7fedfb24f842beb98a6129611850c93190467bc117552022b9ad678cb4138995c1c0ce0cfdb27010b6825c9b4bc1847d920e9ab

C:\Users\Admin\AppData\Local\Temp\2DB7.exe

MD5 bf8c7929bc3f4fad1da578dd2b73cc0d
SHA1 716a6662f38f3ebb7b2081cf620fc2bf58b4d21e
SHA256 aa123ff84c9fc24ff4fd58d0b5796b6b176976774b877efd9ec1c8263e87b08f
SHA512 afbc94473c1518114649de98a7fedfb24f842beb98a6129611850c93190467bc117552022b9ad678cb4138995c1c0ce0cfdb27010b6825c9b4bc1847d920e9ab

memory/4036-140-0x0000000000000000-mapping.dmp

memory/2268-139-0x0000000000669000-0x000000000073F000-memory.dmp

memory/2268-141-0x00000000022F0000-0x0000000002405000-memory.dmp

memory/2268-142-0x0000000000400000-0x0000000000517000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

MD5 6ea8a6cc5fed6c664df1b3ef7c56b55d
SHA1 6b244d708706441095ae97294928967ddf28432b
SHA256 2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA512 4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

memory/4036-145-0x0000000004170000-0x0000000004895000-memory.dmp

memory/4036-146-0x0000000004170000-0x0000000004895000-memory.dmp

memory/4036-147-0x00000000049A0000-0x0000000004AE0000-memory.dmp

memory/4036-148-0x00000000049A0000-0x0000000004AE0000-memory.dmp

memory/4036-149-0x00000000049A0000-0x0000000004AE0000-memory.dmp

memory/4036-150-0x00000000049A0000-0x0000000004AE0000-memory.dmp

memory/4036-151-0x00000000049A0000-0x0000000004AE0000-memory.dmp

memory/2432-153-0x00007FF67E776890-mapping.dmp

memory/4036-152-0x00000000049A0000-0x0000000004AE0000-memory.dmp

memory/2432-154-0x0000013F68890000-0x0000013F689D0000-memory.dmp

memory/2432-155-0x0000013F68890000-0x0000013F689D0000-memory.dmp

memory/4036-156-0x0000000004A19000-0x0000000004A1B000-memory.dmp

memory/2432-157-0x0000000000C00000-0x0000000000E19000-memory.dmp

memory/2432-158-0x0000013F66EC0000-0x0000013F670EA000-memory.dmp

memory/4036-159-0x0000000004170000-0x0000000004895000-memory.dmp

C:\Program Files (x86)\WindowsPowerShell\Modules\main.dll

MD5 393f37717975f7ec877386128049bb09
SHA1 628570419a252a7877d0057cc78e5d32186950d8
SHA256 3403e946041361aaf52a5ef445f1d86e7e43b0f450a21831b9169ed8089a16a7
SHA512 e2c1e223c7866d534fd1ccc69942789e0ab2866625597d947edce145b92d2acb081715441b91f59fb48445595729654156233ef41e7abf8c951a314546c11720

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 ba356d5ad2accbd05cba4ccb8b4219ec
SHA1 210ba30d539797a80e801fafc5b8434e8fae087c
SHA256 1dd52a0a7fdedfcd02d825ab229251d36c76277c16163555060e209cec395384
SHA512 19f2913e0d128d8b5b8c4ecf3f623ccdbe70378e9f9f58798c0d3d26b998afd78b3007ff012f7f279aa38af1eb0174ed7340611423e44bd9aa00b3ad5894368f

\??\c:\program files (x86)\windowspowershell\modules\main.dll

MD5 393f37717975f7ec877386128049bb09
SHA1 628570419a252a7877d0057cc78e5d32186950d8
SHA256 3403e946041361aaf52a5ef445f1d86e7e43b0f450a21831b9169ed8089a16a7
SHA512 e2c1e223c7866d534fd1ccc69942789e0ab2866625597d947edce145b92d2acb081715441b91f59fb48445595729654156233ef41e7abf8c951a314546c11720

memory/4640-163-0x0000000003A00000-0x0000000004125000-memory.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe.xml

MD5 88edd5a41ab82f584c96038657f61fa0
SHA1 7196dd2233a620172932cbe75afc1eae004de540
SHA256 fc79e5ee3a80f00498b8be20796daacc279aee43b522cf3a968266c629e27ff5
SHA512 d75a11ab48d11114c753a1cb7c1cb3ef19e5b5e90818d6842278d28d72d85582aabfbcf324af94abc1fe47ed7b1d7cfd9660852dc59f9026f812a662adfbee4d

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

MD5 ba356d5ad2accbd05cba4ccb8b4219ec
SHA1 210ba30d539797a80e801fafc5b8434e8fae087c
SHA256 1dd52a0a7fdedfcd02d825ab229251d36c76277c16163555060e209cec395384
SHA512 19f2913e0d128d8b5b8c4ecf3f623ccdbe70378e9f9f58798c0d3d26b998afd78b3007ff012f7f279aa38af1eb0174ed7340611423e44bd9aa00b3ad5894368f

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe.xml

MD5 539930de67b99bab23fe2c67000eeddb
SHA1 6b0e5ece46ecb0b019ec71caa44facf122647059
SHA256 2f578443ca2045e8432f4a39bcd367ae343405e8daf368dff91e9198fa1a658c
SHA512 ddddcd7011ad0fb53fc816056a6df2045a7956158c009d8a708eafd0b2eaeccc55a847c96894ee04542315cec373165efc0e331da6316ceb9e5768f8861946ce

memory/3564-170-0x0000000000000000-mapping.dmp

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe.xml

MD5 993d82e37af681bd65f1d428b6ee281e
SHA1 bb1a8402cfccd1d97ea58d6136847a4dd1ba0f65
SHA256 1bc1d4525a46e58edd165a9d792f50441ea3cbcecd14022dc112e02f3d9b5bf8
SHA512 4eb247e384ffa84460e43abe7563643de30f397b628c02f3e6e51c69669d5d7b8be6ebe51355586e5cd5a252652e0eef7f1bd0219b416b61e1db318db4ac833c

memory/4640-172-0x0000000003A00000-0x0000000004125000-memory.dmp

C:\Program Files (x86)\WindowsPowerShell\Modules\main.dll

MD5 393f37717975f7ec877386128049bb09
SHA1 628570419a252a7877d0057cc78e5d32186950d8
SHA256 3403e946041361aaf52a5ef445f1d86e7e43b0f450a21831b9169ed8089a16a7
SHA512 e2c1e223c7866d534fd1ccc69942789e0ab2866625597d947edce145b92d2acb081715441b91f59fb48445595729654156233ef41e7abf8c951a314546c11720

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\StorageHealthModel.dat

MD5 1ffbb6bf6ac240feb3fada4eedbe5310
SHA1 3f8ef6d47bda2b464024e8d09577591fab2685d7
SHA256 c09e4425d87b888993f114755887611f68d351961e429628b952b9b62b49ef5a
SHA512 18c37c2c207664a231144dced3f8a4b97c3787da1174c08f357d9d6e80ae5cd68bcaf2c89062371b40ac9d235a882053bb80d46c28ff7f4e85c2ab25dc5a7081

C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch

MD5 0c19329f1a0959d6e069dd77dc32e7fc
SHA1 8216c5d18000ff6c11f0b562a85d650b3e07da7c
SHA256 ca469f2580e20b3d1077355a1e0e673be724ac15ab15e859b7bc3bcf60854120
SHA512 fbbe1626c32f7b77c77fa1e0e5f0c22562d3bdc15a4290cf300625efa782c31d9ac461ea2b6552dbc42f16137bfc226d98ee2f002a353245eae6afca873e912d

memory/3564-173-0x0000000004740000-0x0000000004E65000-memory.dmp

memory/3564-174-0x0000000004740000-0x0000000004E65000-memory.dmp

memory/3744-175-0x0000000000000000-mapping.dmp