lumma | 52fb8ffb7ccce4a3f89cc4804c7909da51cbe307b07baaa0f8360823f6e69cc7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2025, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe
Size 4.0MB
Sample250702-xd65razvb1
SHA256 52fb8ffb7ccce4a3f89cc4804c7909da51cbe307b07baaa0f8360823f6e69cc7
MD5 dd77e6a2c8750c7590d967cf4b153998
SHA1 957a87daca16b70649e23e3f506cccdbe8b22984
SHA512 969be83a61eadd9aa6d86f3724155a7f885218dde919948cd5e1f08e41d6e50d074f5300fbe4f6fb4a4520bcd87e0013dce504eb6a47c24aaeb39d51d11e21a8
SSDEEP 98304:3wyMBap7IjfgKwgEAmiWDxk1BDjGdsXk4Y05hWNEERrA//EoZZ:3wyMBap5hiWDkDaJX0eTrA//E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery persistence privilege_escalation stealer

Malware Config

Extracted

Family

lumma

https://invertdbdi.top/xjit
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://stochalyqp.xyz/alfp
https://diecam.top/laur
https://citellcagt.top/gjtu
https://saokwe.xyz/plxa

Attributes

build_id
087549ff160e33500ff9dc9a2677f11a

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\xdwdZoom.exe"	kNkQT4DtUm.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\Control Panel\International\Geo\Nation	SzeAbOe5jt.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe	nO1IMP3feq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe	nO1IMP3feq.exe

Executes dropped EXE 4 IoCs

pid	Process
5448	kNkQT4DtUm.exe
4944	SzeAbOe5jt.exe
900	nO1IMP3feq.exe
5912	2nwtlKQubW.exe

Loads dropped DLL 41 IoCs

pid	Process
5176	Process not Found
5960	Process not Found
2536	Process not Found
5688	Process not Found
5300	Process not Found
4080	Process not Found
5016	Process not Found
4620	Process not Found
2096	Process not Found
6060	Process not Found
3840	Process not Found
3744	Process not Found
4480	Process not Found
2384	Process not Found
3460	Process not Found
3236	Process not Found
5020	Process not Found
5740	Process not Found
5776	Process not Found
2304	Process not Found
2500	Process not Found
3768	Process not Found
764	Process not Found
3032	Process not Found
2900	Process not Found
1172	Process not Found
5692	Process not Found
2596	Process not Found
4908	Process not Found
3056	Process not Found
1348	Process not Found
5672	Process not Found
5248	Process not Found
2344	Process not Found
4472	Process not Found
4364	Process not Found
1668	Process not Found
1008	Process not Found
2064	Process not Found
2432	Process not Found
5980	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg978967 = "C:\\Users\\Admin\\AppData\\Roaming\\xdwdMicrosoft Edge DevTools.exe"	kNkQT4DtUm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	pastebin.com
41	pastebin.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 5912 set thread context of 5564	5912	2nwtlKQubW.exe	106

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	kNkQT4DtUm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SzeAbOe5jt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 40 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4196	schtasks.exe
3216	schtasks.exe
2024	schtasks.exe
2352	schtasks.exe
1536	schtasks.exe
696	schtasks.exe
5972	schtasks.exe
4016	schtasks.exe
4604	schtasks.exe
2264	schtasks.exe
2444	schtasks.exe
5324	schtasks.exe
5236	schtasks.exe
728	schtasks.exe
716	schtasks.exe
2060	schtasks.exe
3268	schtasks.exe
5896	schtasks.exe
1336	schtasks.exe
1716	schtasks.exe
1524	schtasks.exe
5044	schtasks.exe
3648	schtasks.exe
2500	schtasks.exe
5596	schtasks.exe
6020	schtasks.exe
4360	schtasks.exe
5188	schtasks.exe
1460	schtasks.exe
3032	schtasks.exe
2996	schtasks.exe
4516	schtasks.exe
1520	schtasks.exe
1712	schtasks.exe
6128	schtasks.exe
544	schtasks.exe
3428	schtasks.exe
1304	schtasks.exe
1372	schtasks.exe
2344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5564	MSBuild.exe
5564	MSBuild.exe
5564	MSBuild.exe
5564	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5448	kNkQT4DtUm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 5076	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	95
PID 1952 wrote to memory of 5076	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	95
PID 1952 wrote to memory of 5076	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	95
PID 1952 wrote to memory of 4748	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	96
PID 1952 wrote to memory of 4748	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	96
PID 1952 wrote to memory of 4748	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	96
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 1952 wrote to memory of 5092	1952	2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe	97
PID 5092 wrote to memory of 5448	5092	MSBuild.exe	100
PID 5092 wrote to memory of 5448	5092	MSBuild.exe	100
PID 5092 wrote to memory of 4944	5092	MSBuild.exe	101
PID 5092 wrote to memory of 4944	5092	MSBuild.exe	101
PID 5092 wrote to memory of 4944	5092	MSBuild.exe	101
PID 4944 wrote to memory of 900	4944	SzeAbOe5jt.exe	102
PID 4944 wrote to memory of 900	4944	SzeAbOe5jt.exe	102
PID 4944 wrote to memory of 5912	4944	SzeAbOe5jt.exe	103
PID 4944 wrote to memory of 5912	4944	SzeAbOe5jt.exe	103
PID 5912 wrote to memory of 5548	5912	2nwtlKQubW.exe	105
PID 5912 wrote to memory of 5548	5912	2nwtlKQubW.exe	105
PID 5912 wrote to memory of 5548	5912	2nwtlKQubW.exe	105
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5912 wrote to memory of 5564	5912	2nwtlKQubW.exe	106
PID 5448 wrote to memory of 3188	5448	kNkQT4DtUm.exe	108
PID 5448 wrote to memory of 3188	5448	kNkQT4DtUm.exe	108
PID 3188 wrote to memory of 1460	3188	CMD.exe	110
PID 3188 wrote to memory of 1460	3188	CMD.exe	110
PID 5448 wrote to memory of 1956	5448	kNkQT4DtUm.exe	111
PID 5448 wrote to memory of 1956	5448	kNkQT4DtUm.exe	111
PID 1956 wrote to memory of 696	1956	CMD.exe	113
PID 1956 wrote to memory of 696	1956	CMD.exe	113
PID 5448 wrote to memory of 4632	5448	kNkQT4DtUm.exe	114
PID 5448 wrote to memory of 4632	5448	kNkQT4DtUm.exe	114
PID 4632 wrote to memory of 3268	4632	CMD.exe	118
PID 4632 wrote to memory of 3268	4632	CMD.exe	118
PID 5448 wrote to memory of 3016	5448	kNkQT4DtUm.exe	122
PID 5448 wrote to memory of 3016	5448	kNkQT4DtUm.exe	122
PID 3016 wrote to memory of 3032	3016	CMD.exe	124
PID 3016 wrote to memory of 3032	3016	CMD.exe	124
PID 5448 wrote to memory of 5908	5448	kNkQT4DtUm.exe	130
PID 5448 wrote to memory of 5908	5448	kNkQT4DtUm.exe	130
PID 5908 wrote to memory of 5896	5908	CMD.exe	132
PID 5908 wrote to memory of 5896	5908	CMD.exe	132
PID 5448 wrote to memory of 4988	5448	kNkQT4DtUm.exe	133
PID 5448 wrote to memory of 4988	5448	kNkQT4DtUm.exe	133
PID 4988 wrote to memory of 1712	4988	CMD.exe	135
PID 4988 wrote to memory of 1712	4988	CMD.exe	135
PID 5448 wrote to memory of 5624	5448	kNkQT4DtUm.exe	136
PID 5448 wrote to memory of 5624	5448	kNkQT4DtUm.exe	136
PID 5624 wrote to memory of 2996	5624	CMD.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2025-07-02_dd77e6a2c8750c7590d967cf4b153998_black-basta_cobalt-strike_luca-stealer_ryuk_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Roaming\kNkQT4DtUm.exe
    "C:\Users\Admin\AppData\Roaming\kNkQT4DtUm.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Programm" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Programm" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1460
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:696
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Eclipse" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Edge DevTools.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Eclipse" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Edge DevTools.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3268
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3032
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5908
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5896
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1712
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5624
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2996
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3692
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3216
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:4180
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1336
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:5892
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1716
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3336
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2024
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:1236
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1304
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:4288
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1372
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:4492
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5596
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:5580
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1524
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:4972
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6020
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:5372
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4516
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:1176
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5972
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3692
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5324
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3360
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1520
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:6136
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2344
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:2280
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4360
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:5524
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2352
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:5700
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5236
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:4568
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:728
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:5368
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4016
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3936
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4604
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:4956
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5044
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3436
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1536
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:1032
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:716
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:2160
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3648
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:224
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2500
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:2844
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4196
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:2408
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6128
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:876
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:544
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:4044
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5188
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3912
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2264
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:6068
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2060
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:3392
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3428
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST & exit
      4⤵
      PID:5708
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Word Host" /tr "C:\Users\Admin\AppData\Local\xdwdZoom.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2444
- - C:\Users\Admin\AppData\Roaming\SzeAbOe5jt.exe
    "C:\Users\Admin\AppData\Roaming\SzeAbOe5jt.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Users\Admin\AppData\Roaming\nO1IMP3feq.exe
      "C:\Users\Admin\AppData\Roaming\nO1IMP3feq.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:900
  - - C:\Users\Admin\AppData\Roaming\2nwtlKQubW.exe
      "C:\Users\Admin\AppData\Roaming\2nwtlKQubW.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5912
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:5548
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Edge DevTools.exe
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2nwtlKQubW.exe

Path C:\Users\Admin\AppData\Roaming\2nwtlKQubW.exe
Size 1.8MB
SHA256 d19f9627cbdb2a002101133c020948237a2837b8ffd5136b8399e61b9735bba1
MD5 191cbfd6af39b7edb4f877798d109067
SHA1 949fe881c46eb0f322742882bc782dacbeae5d46
SHA512 25cc6b1c9698bd6c8cc5a89bd85d18cfe3f42637e2c90765058dff9b9939c427a72dc5ed5835876099598eb4bf7f1a85e23b3b6695b187ac5c1b74d2c963cd0f
SSDEEP 49152:locb+QxtFMjyMRiIaLl75oLjfgFMwDLH4EdLlMU+5IfpRA:xwyMBap7IjfgKwgEH3fp
MD5 SHA1 SHA512 SSDEEP

Submit Download

SzeAbOe5jt.exe

Path C:\Users\Admin\AppData\Roaming\SzeAbOe5jt.exe
Size 2.0MB
SHA256 aa11128385f0a82ee4d5acba0f10567736d618b0fad05f0192b574cbcb33ab65
MD5 ed5beb283eba128f67c8b6c859c99fc1
SHA1 66202cae7e3b9437f120b6bee957f41415d0d166
SHA512 b32d048ca5044d4e4a414e2bb00c9270a04cdf90880672e47e4153042733ecdf7a80b94eb30f4dcab62fafe350d0bdc7689ffd06f83f7f945c894c59c1c61ce3
SSDEEP 49152:j1eFFZfNFhxAyQbwotsFXH1QNHRTeQLf1Ruxsizxeo:j1gHh0t6H10teQL++i9
MD5 SHA1 SHA512 SSDEEP

Submit Download

kNkQT4DtUm.exe

Path C:\Users\Admin\AppData\Roaming\kNkQT4DtUm.exe
Size 327KB
SHA256 a9696560dc2c7e6e43f216df2a877b1577dff440c856369cc74d266d68db52f8
MD5 41c99ed19f6527346aaf5726736f73eb
SHA1 0e487a7e062703f5cc18caff0c4a37111f9ea41d
SHA512 b7d840d1af44c72bc3d36fcc17f7776a7b0698cc63d64948eefee6d5dc92ee34b325e5285484d7721d6096ab9dcaf8f66e369388b4756614d6ffb4a6aa0b01a3
SSDEEP 6144:O8l4CGC0D3rHlTe6VlWT8b9kMUZXbySbarFijwx1:OhCI1PVle8D4Ehijwx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

nO1IMP3feq.exe

Path C:\Users\Admin\AppData\Roaming\nO1IMP3feq.exe
Size 11KB
SHA256 b3345ab02ca9c19e600350c4852499b433f1da3699f1793b89ac8ded09f053ab
MD5 287ab028f1ceab5f2e96de2eead2debc
SHA1 1aefa06d5273076127f5df221dc68f7b7c614793
SHA512 2a784aa8b3832bfc4ce0d2f1a4ca472e3002dd45700ae855bd440c5430f4f4003bc5377344461be72fd9302c350357b5ed1b1f3097394d45627f5cea8caf59af
SSDEEP 192:M9bXfZ/HsmmPlAj2F7R0UZm7NVA6p3+PHK2d2yX5Xz6MWD9ep:07fZ/HxmPlAjEqUZ+m6Z+Pq23Xd6MWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/900-50-0x000002A0B2820000-0x000002A0B2828000-memory.dmp

Download

memory/5092-2-0x0000000000400000-0x0000000000687000-memory.dmp

Download

memory/5092-26-0x0000000000400000-0x0000000000687000-memory.dmp

Download

memory/5092-22-0x0000000000400000-0x0000000000687000-memory.dmp

Download

memory/5092-0-0x0000000000400000-0x0000000000687000-memory.dmp

Download

memory/5092-4-0x0000000000400000-0x0000000000687000-memory.dmp

Download

memory/5092-1-0x0000000000400000-0x0000000000687000-memory.dmp

Download

memory/5448-24-0x00000000004F0000-0x0000000000546000-memory.dmp

Download

memory/5564-53-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/5564-54-0x0000000000400000-0x0000000000461000-memory.dmp

Download