Malware Analysis Report

2025-05-05 21:45

Sample ID 221220-pffftacf2w
Target tmp
SHA256 4162582a729874d7ae84b69bb265fcc1a26ef2635de322bc60c18db397f20912
Tags
danabot banker discovery persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4162582a729874d7ae84b69bb265fcc1a26ef2635de322bc60c18db397f20912

Threat Level: Known bad

The file tmp was found to be: Known bad.

Malicious Activity Summary

danabot banker discovery persistence trojan

Danabot

Sets DLL path for service in the registry

Sets service image path in registry

Blocklisted process makes network request

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Enumerates physical storage devices

Checks processor information in registry

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-12-20 12:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-12-20 12:16

Reported

2022-12-20 12:18

Platform

win7-20221111-en

Max time kernel

126s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\usa\Parameters\ServiceDll = "C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\usa.dll" C:\Windows\SysWOW64\rundll32.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\usa\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1100 set thread context of 1776 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\nppdf32.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\add_reviewer.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\reviewers.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\usa03.ths C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\AdobePiStd.otf C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\svchost.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\svchost.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14145

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows sidebar\shared gadgets\usa.dll",a1IZNmJ6N1o=

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 127.0.0.1:14145 tcp
N/A 127.0.0.1:1312 tcp
N/A 23.236.181.126:443 tcp
N/A 127.0.0.1:14145 tcp
N/A 115.230.19.27:443 tcp
N/A 127.0.0.1:1312 tcp

Files

memory/2044-54-0x00000000007A0000-0x000000000088F000-memory.dmp

memory/2044-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

memory/1100-56-0x0000000000000000-mapping.dmp

memory/2044-57-0x00000000007A0000-0x000000000088F000-memory.dmp

memory/2044-59-0x0000000001E80000-0x0000000001FB0000-memory.dmp

memory/2044-60-0x0000000000400000-0x000000000053E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

MD5 24925b25552a7d8f1d3292071e545920
SHA1 f786e1d40df30f6fed0301d60c823b655f2d6eac
SHA256 9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
SHA512 242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

MD5 24925b25552a7d8f1d3292071e545920
SHA1 f786e1d40df30f6fed0301d60c823b655f2d6eac
SHA256 9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
SHA512 242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

memory/1100-63-0x00000000048C0000-0x0000000004FE5000-memory.dmp

memory/1100-65-0x00000000048C0000-0x0000000004FE5000-memory.dmp

memory/1100-66-0x00000000048C0000-0x0000000004FE5000-memory.dmp

memory/1100-68-0x0000000004420000-0x0000000004560000-memory.dmp

memory/1100-67-0x0000000004420000-0x0000000004560000-memory.dmp

memory/1100-69-0x0000000004420000-0x0000000004560000-memory.dmp

memory/1776-70-0x0000000000120000-0x0000000000339000-memory.dmp

memory/1100-72-0x0000000004420000-0x0000000004560000-memory.dmp

memory/1100-74-0x0000000004420000-0x0000000004560000-memory.dmp

memory/1100-73-0x0000000004420000-0x0000000004560000-memory.dmp

memory/1776-75-0x00000000FFB13CEC-mapping.dmp

memory/1776-77-0x0000000002270000-0x00000000023B0000-memory.dmp

memory/1776-76-0x0000000002270000-0x00000000023B0000-memory.dmp

memory/1776-78-0x0000000000120000-0x0000000000339000-memory.dmp

memory/1776-79-0x0000000002040000-0x000000000226A000-memory.dmp

memory/1776-80-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

memory/1776-81-0x0000000002040000-0x000000000226A000-memory.dmp

memory/1100-82-0x00000000048C0000-0x0000000004FE5000-memory.dmp

\??\c:\program files (x86)\windows sidebar\shared gadgets\usa.dll

MD5 a00cd7e564d95456e7c677705bbbb430
SHA1 f843817568f09a6cab2426214e98c5111e5fefa9
SHA256 283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85
SHA512 2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

\Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

MD5 a00cd7e564d95456e7c677705bbbb430
SHA1 f843817568f09a6cab2426214e98c5111e5fefa9
SHA256 283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85
SHA512 2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

MD5 a079213c2bfcf92ceee4aeda16b66559
SHA1 60bce60149da716a93e7c3a6c44f9b9a4c6342c2
SHA256 26769fd64564cb079aeb7fbb618e0b91fa91dae2f09bf30855f04a917c0b9b13
SHA512 c4f597803410eba8239f4e9c08a58a2c52bbdda500bf271cdc0633b7935ef7a91911f1816794a33569876350716e34cd3a714556429ced2b756a0116356daf0d

memory/1220-87-0x0000000003BA0000-0x00000000042C5000-memory.dmp

memory/1220-89-0x0000000003BA0000-0x00000000042C5000-memory.dmp

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Help_MKWD_BestBet.H1W

MD5 387339f3af4be476613ea7340c31ae7b
SHA1 d80990f15798aa1d70b434969b97b4af462c5a12
SHA256 865af03a88db2214214d53bd11efc032b0fd2ce50be3aa21e09f60b4567c1f31
SHA512 ea4539c3d771d41eab90d3b3904384a1075a95a1e1adcb37992206fb85bde9bfef02dbbfae311a803af0d5947aace8e9be54599b733406fb43bee649d7ff73f1

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\usertile17.bmp

MD5 9afccefdd79314b5812017d7803a531c
SHA1 ad82364a2699b002b8d4ef0fb5a9771988923d94
SHA256 b633e58cd5b3239855b73f78b592283f30e0ce891c0b0373dc73e20b997e6929
SHA512 4ff21922fe0c40bc37ead62a0ee04e6748a5264cf172a3293c08d2df164969497ba3f351872146d43bf2f4a2992637e517c916112346439de7027adc049c3b7f

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\usertile31.bmp

MD5 9be40486ad4e673aec97906a636ccb2b
SHA1 19130bbaf3f33098a884ae68b3e5b0e8e2789c14
SHA256 622d8defdd6b6abd80a45ccec629363cf38a7d338945cf1af27bdfe7d0b777b6
SHA512 9017b561dff451148f1f1a5da2028b2eba6162ab37dceece82b28f28269dd2bb6295d02c097f9550aa87b64841290a7cc587c6aae123168bf53efed0620172ed

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Help_CValidator.H1D

MD5 78f3883f7874696dcd58786ee1d13bea
SHA1 8162c11cbe06fd3106707c3a8bbc284cb4229ab1
SHA256 8aa4719ed70a2f56d42a40943325093c09fc3cdd265dae176fa9e3905d7fed3d
SHA512 4913ed573bafcc9b4e9e8b43cbf91b18a1e2c0c9451ab1ef2a1b64f1c6f994fa17eb13f9e9885fcc1b450cd0122273f255bc6d8e8101514877ce2f217b01343b

memory/1832-94-0x0000000000000000-mapping.dmp

\Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

MD5 a00cd7e564d95456e7c677705bbbb430
SHA1 f843817568f09a6cab2426214e98c5111e5fefa9
SHA256 283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85
SHA512 2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

\Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

MD5 a00cd7e564d95456e7c677705bbbb430
SHA1 f843817568f09a6cab2426214e98c5111e5fefa9
SHA256 283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85
SHA512 2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

\Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

MD5 a00cd7e564d95456e7c677705bbbb430
SHA1 f843817568f09a6cab2426214e98c5111e5fefa9
SHA256 283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85
SHA512 2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

\Program Files (x86)\Windows Sidebar\Shared Gadgets\usa.dll

MD5 a00cd7e564d95456e7c677705bbbb430
SHA1 f843817568f09a6cab2426214e98c5111e5fefa9
SHA256 283faa451e9386e149f5bd4eb077a46fae2ad04ef3d4516670557fbc4220ca85
SHA512 2fead55cbfb9517fe6baa20e7da984f10ee0c55f77e9a3577474495a79022f4a25b316fe15869a080b07e99e64d2afc03115740f510a8324b268564c41f9f87b

memory/1220-100-0x0000000003BA0000-0x00000000042C5000-memory.dmp

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

MD5 4d5c1ae104517b4fd3fa59cf82304f13
SHA1 20114f1cc1f12b8ccc2175556d48aa8c4057d069
SHA256 2654df90386e086328e1f8d0e755fc1d3b1ac13d054f06588dd61e2161248de5
SHA512 7485c8577fbfcffe2746047fa9faef49aa7d6ba1ec92d5995780e1a707a596e3c4e49a52aa2f54694a065182b4c8312d65933800b0b1103fdb1fa003be2d08c9

memory/1832-102-0x0000000003B10000-0x0000000004235000-memory.dmp

memory/1832-105-0x0000000003B10000-0x0000000004235000-memory.dmp

memory/1832-104-0x0000000003B10000-0x0000000004235000-memory.dmp

memory/1832-106-0x0000000003B10000-0x0000000004235000-memory.dmp

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

memory/1220-109-0x0000000003BA0000-0x00000000042C5000-memory.dmp

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

\Program Files\Mozilla Firefox\firefox.exe

MD5 d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1 124d3c2ba93644ac6c2d7253de242b46be836692
SHA256 8bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512 f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234

memory/2016-112-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-12-20 12:16

Reported

2022-12-20 12:18

Platform

win10v2004-20220812-en

Max time kernel

135s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

Signatures

Danabot

trojan banker danabot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\A12_Spinner\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\A12_Spinner.dll" C:\Windows\SysWOW64\rundll32.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\A12_Spinner\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2240 set thread context of 3540 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_asym.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\DVA.api C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\A12_Spinner.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\turnOffNotificationInAcrobat.gif C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Onix32.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook.png C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Onix32.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\ccme_asym.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Eula.exe C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\rundll32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision C:\Windows\SysWOW64\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4600 -ip 4600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 252

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14109

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k LocalService

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\a12_spinner.dll",hCpaelIz

C:\Windows\SysWOW64\schtasks.exe

schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask

C:\Windows\SysWOW64\schtasks.exe

schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask

Network

Country Destination Domain Proto
N/A 23.236.181.126:443 23.236.181.126 tcp
N/A 93.184.221.240:80 tcp
N/A 66.85.173.3:443 66.85.173.3 tcp
N/A 127.0.0.1:14109 tcp
N/A 127.0.0.1:1312 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 23.236.181.126:443 tcp
N/A 127.0.0.1:14109 tcp
N/A 57.249.145.44:443 tcp
N/A 224.0.0.251:5353 udp

Files

memory/2240-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

MD5 24925b25552a7d8f1d3292071e545920
SHA1 f786e1d40df30f6fed0301d60c823b655f2d6eac
SHA256 9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
SHA512 242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp

MD5 24925b25552a7d8f1d3292071e545920
SHA1 f786e1d40df30f6fed0301d60c823b655f2d6eac
SHA256 9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b
SHA512 242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

memory/4600-135-0x000000000219B000-0x000000000228A000-memory.dmp

memory/4600-136-0x0000000002310000-0x0000000002440000-memory.dmp

memory/4600-137-0x0000000000400000-0x000000000053E000-memory.dmp

memory/2240-138-0x00000000062E0000-0x0000000006A05000-memory.dmp

memory/2240-139-0x00000000062E0000-0x0000000006A05000-memory.dmp

memory/2240-141-0x0000000005030000-0x0000000005170000-memory.dmp

memory/2240-140-0x0000000005030000-0x0000000005170000-memory.dmp

memory/2240-142-0x0000000005030000-0x0000000005170000-memory.dmp

memory/2240-143-0x0000000005030000-0x0000000005170000-memory.dmp

memory/2240-145-0x0000000005030000-0x0000000005170000-memory.dmp

memory/3540-146-0x00007FF738BE6890-mapping.dmp

memory/2240-144-0x0000000005030000-0x0000000005170000-memory.dmp

memory/3540-147-0x000002A32F420000-0x000002A32F560000-memory.dmp

memory/3540-148-0x000002A32F420000-0x000002A32F560000-memory.dmp

memory/2240-149-0x00000000050A9000-0x00000000050AB000-memory.dmp

memory/3540-150-0x0000000000130000-0x0000000000349000-memory.dmp

memory/3540-151-0x000002A32F5A0000-0x000002A32F7CA000-memory.dmp

memory/2240-152-0x00000000062E0000-0x0000000006A05000-memory.dmp

\??\c:\program files (x86)\windowspowershell\modules\a12_spinner.dll

MD5 e3cd84b47ea48415041634b89fa03347
SHA1 e4dee6ffb3fcca7c2665198838d54fc81b5c8422
SHA256 596565dbbc4e7c29c4908fc6f01571a07a46b59e882b41e369e0c87fa38931b1
SHA512 bea53db42e5d889afe3b61950e84b4e45d6c2777250ae369e37bb9ead879297960a20d7602c2ec82329ba7e98f3bba62b83f6d4869ac4ee67f6740ff285e163d

C:\Program Files (x86)\WindowsPowerShell\Modules\A12_Spinner.dll

MD5 e3cd84b47ea48415041634b89fa03347
SHA1 e4dee6ffb3fcca7c2665198838d54fc81b5c8422
SHA256 596565dbbc4e7c29c4908fc6f01571a07a46b59e882b41e369e0c87fa38931b1
SHA512 bea53db42e5d889afe3b61950e84b4e45d6c2777250ae369e37bb9ead879297960a20d7602c2ec82329ba7e98f3bba62b83f6d4869ac4ee67f6740ff285e163d

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

MD5 958f3558d952f0e1f19bf0eff21db3b2
SHA1 35ce6621d1326538855de2ecb151a921990a21d2
SHA256 d076751ecddd3ee7970dd74daca9103690f9987fadf7d3059655aa543e8398a7
SHA512 0d6f4515c10d6b6d9082dc67ec8a6111f3dd7685fcee71a4ce0dd4fefbe5cab6b5ba706dbdc405fd3d98a3ec9c14c8abeac5fb98d33a13dfd06d4a4dc1bea708

memory/4180-156-0x00000000030C0000-0x00000000037E5000-memory.dmp

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\telemetry.ASM-WindowsDefault.json

MD5 fe9f7b7fd16a326e40b72f2424bb9f13
SHA1 a3f40de8864d051cec6d1561192233e3a4b54463
SHA256 3512d316332ebd399244d3fb8a0445c0d8e6be9d37d3052cdf0dc80d2bb77a0b
SHA512 86756198db0909080eb2a6a3b5eefcabaeb59aa10db0189459af59f04c2e24fca322875c045adebc3f1c597d468c9dc71d9ff6dce916b1f891b8c3e16af7c132

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\CiPT0000.002

MD5 08c1446a011937f5608e5f2448443304
SHA1 53e7291e9b33e46a17d9514a6005302e79a36407
SHA256 c10595f1ade2f1adced14a578b437e6958adf631c01a4c167b14b6904eaf2680
SHA512 a7a339940faba59e5a07b715ae39df9de39a4e69913d8d347cd696709a3191483537d1c011a1bea2d5faa222bf768e33dbde5791d04458b7e14a3db494eb6b07

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\AirSpace.Etw.man

MD5 39e5270caae15015c8203fec413669c7
SHA1 f44f5617f2bc496fb497a1e8ad13997ccecf0f6d
SHA256 2e6cbfc09039d76897eaf701179ba2011d2ea134ca8b6c6e9792a0843006a5f1
SHA512 9bdab6d4cea87cd1172a77554c0059dbd5f7f29ca754e4ed21aa99bc4b16f40fc28e32c81f0ab3ea49158c12cc6c5318a81bd942b916c0b1241b2c6818b2657a

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\telemetry.P-Eco3PTelDefault.json

MD5 b658c06c14ff523bce634e14236c9441
SHA1 aa15105fc5cbee478303c5a1d8814a88197573be
SHA256 29633ff726d1c72f895545fd97d546035e7045a046b3d2888ff0950e67b8eb82
SHA512 3326a97db218aa09814e80317c1150f8a6808e8b6aab07af27c8126688b30964cc85936940d310c1d4d6190c49eaa01ee51d598775ec8c156676bbfd53f8f4cc

memory/4736-162-0x0000000000000000-mapping.dmp

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\s640.hash

MD5 bef40d5a19278ca19b56fbcdde7e26ef
SHA1 4f01d5b8de038e120c64bd7cc22cf150af1452fb
SHA256 7f9c7cc5b265e312fc587d98c7c31218b7a46f1efb8c397dcc329354b4e5831d
SHA512 5a361b1378c7b9f635e72ffdfba4d59acd17341caba480a5271237a37d40d8eb03a6ca7f3c38e73ce87a15b682d434ffa0a7f96dd6355e286d8213a80518c493

C:\Program Files (x86)\WindowsPowerShell\Modules\A12_Spinner.dll

MD5 e3cd84b47ea48415041634b89fa03347
SHA1 e4dee6ffb3fcca7c2665198838d54fc81b5c8422
SHA256 596565dbbc4e7c29c4908fc6f01571a07a46b59e882b41e369e0c87fa38931b1
SHA512 bea53db42e5d889afe3b61950e84b4e45d6c2777250ae369e37bb9ead879297960a20d7602c2ec82329ba7e98f3bba62b83f6d4869ac4ee67f6740ff285e163d

C:\ProgramData\{DFE614B1-1B05-F404-C372-1D93E0034A80}\Fwroes.tmp

MD5 61476558518d29bb4603ebe391c74bf5
SHA1 ab40eea12efa8e57a34bb4a3fef31a157fe85026
SHA256 515348dda14ad2d785e57620025d3d5d65cf52a94f04f4c970617deb0f7ae623
SHA512 30361d871b40940d08e3b8882ec477a870f22e19474c45321db7d444b6371d8aa7ae7062fd2613fa8799745ca3eeea18effc7e2609f16826e65a219a20822d67

memory/4180-165-0x00000000030C0000-0x00000000037E5000-memory.dmp

memory/4736-166-0x0000000004450000-0x0000000004B75000-memory.dmp

memory/4736-167-0x0000000004450000-0x0000000004B75000-memory.dmp

memory/2552-168-0x0000000000000000-mapping.dmp

memory/2748-169-0x0000000000000000-mapping.dmp

memory/4180-170-0x00000000030C0000-0x00000000037E5000-memory.dmp