lumma | 19533506a74a8fd80ba932ca930c0805d0f69095d5820683ff757785dbb4359e

Analysis

max time kernel
143s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2023 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

210KB
MD5

0d0655ac3327465e342c8643e0aec261
SHA1

3b60b63f926a4ef0821bc359858fec339327517f
SHA256

19533506a74a8fd80ba932ca930c0805d0f69095d5820683ff757785dbb4359e
SHA512

1b00d21f5de948ef4d5be4a5593eb9a83dcccb84d1bd5ded3c2846a606e731f8d14074cfaaa5511c0a57651239de1870bab314ff5f8fea56022c2b3bc878f970
SSDEEP

3072:rMX15/9Gxad5gWGzaBUOxqNk7EWVRS8Nw4i:rIdGxbaBNx5EsSL

Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1112-133-0x0000000002D30000-0x0000000002D39000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

70 4260 rundll32.exe
81 4260 rundll32.exe
85 4260 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

DF92.exeE44.exe

pid process

3168 DF92.exe
1360 E44.exe

flow	pid	process
70	4260	rundll32.exe
81	4260	rundll32.exe
85	4260	rundll32.exe

pid	process
3168	DF92.exe
1360	E44.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rss\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\rss.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rss\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService"	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exesvchost.exerundll32.exe

pid process

4260 rundll32.exe
3472 svchost.exe
4868 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4260	rundll32.exe
3472	svchost.exe
4868	rundll32.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4260 set thread context of 3864	4260	rundll32.exe	rundll32.exe
PID 4260 set thread context of 384	4260	rundll32.exe	rundll32.exe
PID 4260 set thread context of 2124	4260	rundll32.exe	rundll32.exe
PID 4260 set thread context of 4724	4260	rundll32.exe	schtasks.exe

Drops file in Program Files directory 24 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\CollectSignatures.aapp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\pmd.cer	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Protect_R_RHP.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ViewerPS.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\warning.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\base_uris.js	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\editpdf.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\rss.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\aic_file_icons_highcontrast.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\LICENSE.txt	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ViewerPS.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\apple-touch-icon-72x72-precomposed.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\duplicate.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\editpdf.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5104 3168 WerFault.exe DF92.exe
3856 1360 WerFault.exe E44.exe

pid	pid_target	process	target process
5104	3168	WerFault.exe	DF92.exe
3856	1360	WerFault.exe	E44.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeschtasks.exerundll32.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	schtasks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	schtasks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	svchost.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	schtasks.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	schtasks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	schtasks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	schtasks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies registry class 48 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000030567d15100054656d7000003a0009000400efbe6b55586c305684152e0000000000000000000000000000000000000000000000000028d9ad00540065006d007000000014000000
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

2632

pid	process
2632

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
1112	file.exe
1112	file.exe
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632
2632

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2632
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

file.exe

pid process

1112 file.exe

pid	process
2632

Suspicious use of AdjustPrivilegeToken 57 IoCs

Processes:

rundll32.exe

description	pid	process
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeDebugPrivilege	4260	rundll32.exe
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632
Token: SeShutdownPrivilege	2632
Token: SeCreatePagefilePrivilege	2632

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

pid process

3864 rundll32.exe
2632
2632
2632
2632
384 rundll32.exe
2632
2632
4260 rundll32.exe
2632
2632
2124 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

2632
2632

pid	process
3864	rundll32.exe
2632
2632
2632
2632
384	rundll32.exe
2632
2632
4260	rundll32.exe
2632
2632
2124	rundll32.exe

pid	process
2632
2632

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

DF92.exerundll32.exesvchost.exe

description	pid	process	target process
PID 2632 wrote to memory of 3168	2632		DF92.exe
PID 2632 wrote to memory of 3168	2632		DF92.exe
PID 2632 wrote to memory of 3168	2632		DF92.exe
PID 3168 wrote to memory of 4260	3168	DF92.exe	rundll32.exe
PID 3168 wrote to memory of 4260	3168	DF92.exe	rundll32.exe
PID 3168 wrote to memory of 4260	3168	DF92.exe	rundll32.exe
PID 2632 wrote to memory of 1360	2632		E44.exe
PID 2632 wrote to memory of 1360	2632		E44.exe
PID 2632 wrote to memory of 1360	2632		E44.exe
PID 4260 wrote to memory of 3864	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 3864	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 3864	4260	rundll32.exe	rundll32.exe
PID 3472 wrote to memory of 4868	3472	svchost.exe	rundll32.exe
PID 3472 wrote to memory of 4868	3472	svchost.exe	rundll32.exe
PID 3472 wrote to memory of 4868	3472	svchost.exe	rundll32.exe
PID 4260 wrote to memory of 384	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 384	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 384	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 2124	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 2124	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 2124	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 4724	4260	rundll32.exe	schtasks.exe
PID 4260 wrote to memory of 4724	4260	rundll32.exe	schtasks.exe
PID 4260 wrote to memory of 4724	4260	rundll32.exe	schtasks.exe
PID 4260 wrote to memory of 4724	4260	rundll32.exe	schtasks.exe
PID 4260 wrote to memory of 5004	4260	rundll32.exe	schtasks.exe
PID 4260 wrote to memory of 5004	4260	rundll32.exe	schtasks.exe
PID 4260 wrote to memory of 5004	4260	rundll32.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1112

C:\Users\Admin\AppData\Local\Temp\DF92.exe
C:\Users\Admin\AppData\Local\Temp\DF92.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4260

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18657
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3864

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18657
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:384

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18657
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2124

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
- Checks processor information in registry
PID:4724

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:5004

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:2904

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:4172

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:3520

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 556
2⤵
- Program crash
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3168 -ip 3168
1⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\E44.exe
C:\Users\Admin\AppData\Local\Temp\E44.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1336
2⤵
- Program crash
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1360 -ip 1360
1⤵
PID:2884

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\rss.dll",ST8KV05MVjE2
2⤵
- Loads dropped DLL
- Checks processor information in registry
PID:4868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsPowerShell\Modules\rss.dll

Filesize
774KB

MD5
8ba56be13ae7a847c6b27fd468bd0280

SHA1
8359d6b35b355ec57818ff5800ab7934c9a115ce

SHA256
c97f6737d043d8edcec9fb6b2705a888d864ab1f19a40b6fc36a5c099bfac2f2

SHA512
638cdff91479b035035484a98d1bc65c0c743227afd649f40f005dd55906ad0c16945b5500b2e807153188e3a355cbf6b277c8687cceba12b37b5ae214a50e94

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\rss.dll

Filesize
774KB

MD5
8ba56be13ae7a847c6b27fd468bd0280

SHA1
8359d6b35b355ec57818ff5800ab7934c9a115ce

SHA256
c97f6737d043d8edcec9fb6b2705a888d864ab1f19a40b6fc36a5c099bfac2f2

SHA512
638cdff91479b035035484a98d1bc65c0c743227afd649f40f005dd55906ad0c16945b5500b2e807153188e3a355cbf6b277c8687cceba12b37b5ae214a50e94

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\DiagnosticLogCSP_Collector_DeviceProvisioning_2022_11_11_13_34_10.etl

Filesize
256KB

MD5
64852277754d0707fccd9c64753c42a4

SHA1
e9cb057db03d84200299651d9817fa66b78e9a5a

SHA256
73a10cd69944d5c765e076c652020f0c15d8864b68bf281e4d61f279c71e1ebc

SHA512
abdac10eeae4fbe8a4a50d63d6af77ea1bcf27339096ce5e9a4f7189f17f00c3516d0fa94adc71d76567251e05a08ecb280681767b4a117e43d72f7b86b627a1

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\EaseOfAccessSettings2013.xml

Filesize
5KB

MD5
7ac38dcc72989ac01bd1a67d484af471

SHA1
458224b5c1c1696d8255a355a6100a4652fd7bd7

SHA256
923335d4d6399bd1bc2d44d264183cba0e2a2c3ecb1d18472003e787275d7e46

SHA512
ae5f247648411df8657a2806e5a9ff8e48bf79cf19d2b4101ef67fa78d7b55e37248190ed1d60f58255fe5ceff38017764b0a0d73108150dd4666dde75c0ce14

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\MicrosoftOffice2016BackupWin64.xml

Filesize
12KB

MD5
2d995c7aa8d041ffa18821c898bc2cb7

SHA1
f16ef806d79bffeec76f27102bd8e1273a0f3747

SHA256
614e99dbea133397b0b4ee8a222df8502f8f782fbcdd44651793c1c894281948

SHA512
81dcbfa24e216bf2a06379ca7d830bd6e16b58c16cd595704903a636f770eb70ca2146ec682559b48e9ff2518cbf3e1ed693050938a9a2b2e478eba6b86959e6

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Uqioyhuair.tmp

Filesize
3.5MB

MD5
cf020d76a6e19b1e7f20f818aaee2d84

SHA1
9d16e77380443c74c1ec65d5e1734c7af69add51

SHA256
c30f79cfeef7b4727f0a922dc61215fffb348d64508509af666fa47e415d89ce

SHA512
4772be90804c975d2942dee31640559063242baccff11a4513f65ee1bbf8db182e7118f9dc1cb24077b03487a92cbcb76c7c0b7cc9a49da0e2376a6b238f9d28

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\background.png

Filesize
126KB

MD5
9adaf3a844ce0ce36bfed07fa2d7ef66

SHA1
3a804355d5062a6d2ed9653d66e9e4aebaf90bc0

SHA256
d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698

SHA512
e6988737153a0996b14e6baa45e8010ff46714fe7679d05a2676cc18e1c653e99227e7507cdae4f2b6a99b3c31478630e7e1ae13d0f7c12525406d8cf9867ca5

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\resource.xml

Filesize
1KB

MD5
66963736ebb1e54dc596701206eaed3f

SHA1
18bc8dfc779d407398af193f3d265ff93f253bc2

SHA256
fd5f68b59aa2b3e80b1a3d97b1dc5028e0fb512d26003fffce146209fedc814b

SHA512
96aef899ecfb48d1df6e8c7655d59fb80b3c65f18857692894598b78c14b5587433d5f58a2d9bbd74d635956a9e6f1948916bd354e6d438450f37ec11cc3b598

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\scan_settings.ico

Filesize
62KB

MD5
8f6abfe0c274c41c3ad3c1becf2317f5

SHA1
6dc69b46e569ca11e3ec081293df69a6d115674c

SHA256
d660f44fb7efbfdcec4cba821fea1be0977e3f66cc709b313edf9ead575994a5

SHA512
ed474a6d52df65b5bf7a1bd81d54458a1258571f16b28ce043189815bf6dc57c49cb31c6f48fed9791de6b69f93331282a0c6e76e54d488ddad7e30d2333a1b2

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\settings.ico

Filesize
66KB

MD5
4896c2ad8ca851419425b06ec0fd95f2

SHA1
7d52e9355998f1b4487f8ef2b1b3785dec35d981

SHA256
1160a3a774b52f07453bde44755fbf76a8b1534c5ade19402f05857c249056b3

SHA512
271f40a273bc98738d450a8585cc84d097d88bbb6417fd20b4417d31b4e19b1b8fe860d044f70a3e4096588b9615c8cc588b1cab651ab1b4320d7ce1d74eb8f2

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\stream.x64.en-us.hash

Filesize
128B

MD5
73f303800be636585f9ec14701cd8d5e

SHA1
456304dc888d5eaa159fa0fa34fc9bcc3bacb633

SHA256
c8e3762853e17a3bd49882b0d36afa285bed5639f8f9e88f716c3942e28b6ace

SHA512
8a80ee6d1b074d68a55bbb3d5be251cfaae89b0345a6b0e84a6359e8c1453c8bf0969e6d33a7d0523d30d586c46c1eede9e71f7a89f7bc67ea0ad866671b81b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF92.exe

Filesize
1.1MB

MD5
de3dcb40231ca68617243ab3bd2777cd

SHA1
d01496824a45e5ad2846d6143ccdf4e1d1cb4e50

SHA256
5b640da222c602b0b3a3f14c85afe969eb4a94d1cf3c0b531845e072ba2492d2

SHA512
542bb8dbbf70742266b6c3bf656d7c6745658c5fa8c235257c74e27d376e0b1f4bc1e379143813462cf4cffd6baa7ae606dcf4861b95264131ebf624eaab756d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF92.exe

Filesize
1.1MB

MD5
de3dcb40231ca68617243ab3bd2777cd

SHA1
d01496824a45e5ad2846d6143ccdf4e1d1cb4e50

SHA256
5b640da222c602b0b3a3f14c85afe969eb4a94d1cf3c0b531845e072ba2492d2

SHA512
542bb8dbbf70742266b6c3bf656d7c6745658c5fa8c235257c74e27d376e0b1f4bc1e379143813462cf4cffd6baa7ae606dcf4861b95264131ebf624eaab756d

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44.exe

Filesize
248KB

MD5
e2d40676fa2b1dd7966d50ccbf5acbde

SHA1
e54498df173d571cff586b7594762b054ced5ea6

SHA256
7b9e17219d79e0535177f413836088cf5fafb5854f3d2b18856a9834e0ef2084

SHA512
3b70d0ad0b660360381654a63bc4989a982ba505ae2183bc4b31573c083eb703c8c01ae57df7c48a4dde937774067fbd7680054c90b50abcb7e056bc445059df

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44.exe

Filesize
248KB

MD5
e2d40676fa2b1dd7966d50ccbf5acbde

SHA1
e54498df173d571cff586b7594762b054ced5ea6

SHA256
7b9e17219d79e0535177f413836088cf5fafb5854f3d2b18856a9834e0ef2084

SHA512
3b70d0ad0b660360381654a63bc4989a982ba505ae2183bc4b31573c083eb703c8c01ae57df7c48a4dde937774067fbd7680054c90b50abcb7e056bc445059df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp

Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp

Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
\??\c:\program files (x86)\windowspowershell\modules\rss.dll

Filesize
774KB

MD5
8ba56be13ae7a847c6b27fd468bd0280

SHA1
8359d6b35b355ec57818ff5800ab7934c9a115ce

SHA256
c97f6737d043d8edcec9fb6b2705a888d864ab1f19a40b6fc36a5c099bfac2f2

SHA512
638cdff91479b035035484a98d1bc65c0c743227afd649f40f005dd55906ad0c16945b5500b2e807153188e3a355cbf6b277c8687cceba12b37b5ae214a50e94

Download Submit
memory/384-194-0x00000269375F0000-0x0000026937730000-memory.dmp

Filesize
1.2MB

Download
memory/384-193-0x00000269375F0000-0x0000026937730000-memory.dmp

Filesize
1.2MB

Download
memory/384-195-0x0000026935D10000-0x0000026935FC5000-memory.dmp

Filesize
2.7MB

Download
memory/384-196-0x0000026935D10000-0x0000026935FC5000-memory.dmp

Filesize
2.7MB

Download
memory/384-192-0x00007FF744736890-mapping.dmp

Download
memory/1112-132-0x0000000002DB9000-0x0000000002DCA000-memory.dmp

Filesize
68KB

Download
memory/1112-135-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/1112-134-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/1112-133-0x0000000002D30000-0x0000000002D39000-memory.dmp

Filesize
36KB

Download
memory/1360-154-0x0000000000400000-0x0000000002BA6000-memory.dmp

Filesize
39.6MB

Download
memory/1360-156-0x0000000000400000-0x0000000002BA6000-memory.dmp

Filesize
39.6MB

Download
memory/1360-145-0x0000000000000000-mapping.dmp

Download
memory/1360-149-0x0000000002E19000-0x0000000002E32000-memory.dmp

Filesize
100KB

Download
memory/1360-150-0x00000000047A0000-0x00000000047CA000-memory.dmp

Filesize
168KB

Download
memory/1360-151-0x0000000000400000-0x0000000002BA6000-memory.dmp

Filesize
39.6MB

Download
memory/1360-153-0x0000000002E19000-0x0000000002E32000-memory.dmp

Filesize
100KB

Download
memory/2124-204-0x00000278D7AD0000-0x00000278D7C10000-memory.dmp

Filesize
1.2MB

Download
memory/2124-201-0x00007FF744736890-mapping.dmp

Download
memory/2124-205-0x00000278D6070000-0x00000278D6325000-memory.dmp

Filesize
2.7MB

Download
memory/2124-203-0x00000278D7AD0000-0x00000278D7C10000-memory.dmp

Filesize
1.2MB

Download
memory/2904-218-0x0000000000000000-mapping.dmp

Download
memory/3168-140-0x00000000049D0000-0x0000000004AFE000-memory.dmp

Filesize
1.2MB

Download
memory/3168-139-0x00000000047D5000-0x00000000048BD000-memory.dmp

Filesize
928KB

Download
memory/3168-136-0x0000000000000000-mapping.dmp

Download
memory/3168-141-0x0000000000400000-0x0000000002C75000-memory.dmp

Filesize
40.5MB

Download
memory/3168-148-0x0000000000400000-0x0000000002C75000-memory.dmp

Filesize
40.5MB

Download
memory/3244-221-0x0000000000000000-mapping.dmp

Download
memory/3472-172-0x0000000003E70000-0x00000000049C5000-memory.dmp

Filesize
11.3MB

Download
memory/3472-184-0x0000000003E70000-0x00000000049C5000-memory.dmp

Filesize
11.3MB

Download
memory/3472-217-0x0000000003E70000-0x00000000049C5000-memory.dmp

Filesize
11.3MB

Download
memory/3520-220-0x0000000000000000-mapping.dmp

Download
memory/3864-164-0x00007FF744736890-mapping.dmp

Download
memory/3864-181-0x000002294A4B0000-0x000002294A765000-memory.dmp

Filesize
2.7MB

Download
memory/3864-165-0x000002294A350000-0x000002294A490000-memory.dmp

Filesize
1.2MB

Download
memory/3864-166-0x000002294A350000-0x000002294A490000-memory.dmp

Filesize
1.2MB

Download
memory/3864-167-0x0000000000090000-0x0000000000334000-memory.dmp

Filesize
2.6MB

Download
memory/3864-168-0x000002294A4B0000-0x000002294A765000-memory.dmp

Filesize
2.7MB

Download
memory/4172-219-0x0000000000000000-mapping.dmp

Download
memory/4260-155-0x00000000051F0000-0x0000000005D45000-memory.dmp

Filesize
11.3MB

Download
memory/4260-157-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-161-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-142-0x0000000000000000-mapping.dmp

Download
memory/4260-190-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-188-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-187-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-162-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-163-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-197-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-198-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-199-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-159-0x00000000051F0000-0x0000000005D45000-memory.dmp

Filesize
11.3MB

Download
memory/4260-200-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-158-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-152-0x00000000051F0000-0x0000000005D45000-memory.dmp

Filesize
11.3MB

Download
memory/4260-160-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4260-189-0x00000000048C0000-0x0000000004A00000-memory.dmp

Filesize
1.2MB

Download
memory/4724-213-0x0000000003690000-0x00000000037D0000-memory.dmp

Filesize
1.2MB

Download
memory/4724-215-0x00000000012D0000-0x0000000001E25000-memory.dmp

Filesize
11.3MB

Download
memory/4724-208-0x0000000003690000-0x00000000037D0000-memory.dmp

Filesize
1.2MB

Download
memory/4724-210-0x0000000003690000-0x00000000037D0000-memory.dmp

Filesize
1.2MB

Download
memory/4724-211-0x0000000003690000-0x00000000037D0000-memory.dmp

Filesize
1.2MB

Download
memory/4724-212-0x0000000003690000-0x00000000037D0000-memory.dmp

Filesize
1.2MB

Download
memory/4724-209-0x00000000012D0000-0x0000000001E25000-memory.dmp

Filesize
11.3MB

Download
memory/4724-214-0x0000000003690000-0x00000000037D0000-memory.dmp

Filesize
1.2MB

Download
memory/4724-206-0x0000000000560000-0x0000000000F96000-memory.dmp

Filesize
10.2MB

Download
memory/4724-202-0x0000000000000000-mapping.dmp

Download
memory/4868-182-0x0000000000000000-mapping.dmp

Download
memory/4868-185-0x0000000005180000-0x0000000005CD5000-memory.dmp

Filesize
11.3MB

Download
memory/4868-186-0x0000000005180000-0x0000000005CD5000-memory.dmp

Filesize
11.3MB

Download
memory/4868-191-0x0000000005180000-0x0000000005CD5000-memory.dmp

Filesize
11.3MB

Download
memory/5004-216-0x0000000000000000-mapping.dmp

Download