Loading ...

Play interactive tourEdit tour

Windows Analysis Report MGrYFpGLQ7.dll

Overview

General Information

Sample Name:MGrYFpGLQ7.dll
Analysis ID:481120
MD5:8c7b2ff105963718fa3c26989e206041
SHA1:831ece0ae6b5e2f373f75352e582abd61b5dd0d7
SHA256:90d8648b2aac0c837286a4c042f02064cfbb12f45b3dc6b00b2beccc7fc35422
Infos:

Most interesting Screenshot:

Detection

Ursnif
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Found stalling execution ending in API Sleep call
Writes or reads registry keys via WMI
Writes registry values via WMI
Machine Learning detection for sample
Uses 32bit PE files
Antivirus or Machine Learning detection for unpacked file
PE file contains an invalid checksum
Tries to load missing DLLs
Contains functionality to read the PEB
May sleep (evasive loops) to hinder dynamic analysis
Found evasive API chain checking for process token information
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 2880 cmdline: loaddll32.exe 'C:\Users\user\Desktop\MGrYFpGLQ7.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 3428 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\MGrYFpGLQ7.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5040 cmdline: rundll32.exe 'C:\Users\user\Desktop\MGrYFpGLQ7.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • regsvr32.exe (PID: 3556 cmdline: regsvr32.exe /s C:\Users\user\Desktop\MGrYFpGLQ7.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • iexplore.exe (PID: 4728 cmdline: C:\Program Files\Internet Explorer\iexplore.exe MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
      • iexplore.exe (PID: 2576 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 6320 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:82952 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 6424 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 6432 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:82954 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 7140 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:82976 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 1256 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:17438 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 6396 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:83004 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 5144 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:17452 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 5704 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:83036 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
      • iexplore.exe (PID: 6020 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4728 CREDAT:17470 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
    • rundll32.exe (PID: 2624 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Bighearted MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 5352 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Soaking MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 6276 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Turnipy MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 6536 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Watertight MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 6708 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Dithery MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7000 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Anhimae MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 1496 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Anostraca MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 2964 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 1068 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Anaerobian MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 6372 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,Sparsile MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 5908 cmdline: rundll32.exe C:\Users\user\Desktop\MGrYFpGLQ7.dll,DllUnregisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000015.00000003.355232631.0000000007528000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000010.00000003.314377890.0000000006878000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000000.00000003.391622099.0000000003138000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
        00000010.00000003.314521084.0000000006878000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
          00000015.00000003.355592572.0000000007528000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
            Click to see the 86 entries

            Sigma Overview

            No Sigma rule has matched

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Antivirus / Scanner detection for submitted sampleShow sources
            Source: MGrYFpGLQ7.dllAvira: detected
            Multi AV Scanner detection for submitted fileShow sources
            Source: MGrYFpGLQ7.dllVirustotal: Detection: 82%Perma Link
            Source: MGrYFpGLQ7.dllMetadefender: Detection: 59%Perma Link
            Source: MGrYFpGLQ7.dllReversingLabs: Detection: 88%
            Machine Learning detection for sampleShow sources
            Source: MGrYFpGLQ7.dllJoe Sandbox ML: detected
            Source: 3.2.rundll32.exe.510000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen8
            Source: 2.2.regsvr32.exe.400000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen8
            Source: 0.2.loaddll32.exe.5f0000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen8
            Source: MGrYFpGLQ7.dllStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll
            Source: unknownHTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.5:49764 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.5:49763 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.5:49820 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.5:49819 version: TLS 1.2
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_00C732BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,0_2_00C732BA
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_040832BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,3_2_040832BA
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_047B32BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,6_2_047B32BA
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_04BF32BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,9_2_04BF32BA
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 12_2_04C032BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,12_2_04C032BA
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 16_2_043532BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,16_2_043532BA
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 18_2_067732BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,18_2_067732BA
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 21_2_04FD32BA RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,21_2_04FD32BA

            Networking:

            barindex
            Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
            Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49859 -> 13.225.29.132:80
            Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49859 -> 13.225.29.132:80
            Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49863 -> 13.225.29.132:80
            Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49907 -> 13.225.29.132:80
            Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49907 -> 13.225.29.132:80
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
            Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
            Source: unknownDNS traffic detected: queries for: www.msn.com
            Source: global trafficHTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: geolocation.onetrust.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /lo/api/res/1.2/BWUYr.M5U6.kf035wsX8Lg--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1pbmk7cT0xMDA-/https://s.yimg.com/av/ads/1621266752856-586.jpg HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: s.yimg.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /images/GCf_2BVR4BU/cjyHO8rEu0PLMD/ddrHkS9VDXWI2BqJDWdKp/yP_2BPG48oRDpm0g/SrPkMCydca7dHbV/D9P1tAQMBBq8SvLL_2/BTpaf4v7U/VLIzcVH0j4WxrbYHQOZI/wYP1aj2dECCu_2F_2BC/mIwNPWeBCD7IMCmF8HTTO6/vdW_2F0_2BicH/w8p9PjDD/HtrueVxg_2FcH01kfOOydSo/XvV_2FKbIAaOsHpHpe/wMhAw.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ocsp.sca1b.amazontrust.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /images/U6TeZm2GqJwloJv5oZSeI/2t0wwSFx0OdeCqwq/a5th_2BJswZzpBo/iTJZVc_2BHgWPPB64R/K3cCyKXGA/pha07BC_2FbaaosXoWHU/mqeKc0qKA2IsvzCoLJ0/i_2FxmVXC6GOzmCalRHRBS/X4qBHSkzHz0Gv/sQEy9HR7/NTPicd5UJLmarL1TQsRZspC/zIbC4QSojh/SXfsKqnthINSBZ4Hv/INUqZbTg0z/T.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ocsp.sca1b.amazontrust.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /images/GosV5rx1jUm_2/FeMYZexn/3AHfZUbwKtZ24NdOcSq0RlX/SFVlCboKYZ/q19iLR0UiFTMXXHua/7HDwQVQwW_2B/P2MZpE_2Fn2/TKqFG_2F5mAVKf/ACPvjzozYdfDpfYzdrt73/e9vTiEyeXLfMugv6/YOqbGPGETO_2FyR/6XOvuQnB29hcTxcqfB/1cP6Y9M6Q/pKhEyMS_2BB/ySEZOj.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ocsp.sca1b.amazontrust.comConnection: Keep-Alive
            Source: unknownHTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.5:49764 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.5:49763 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.5:49820 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.5:49819 version: TLS 1.2

            Key, Mouse, Clipboard, Microphone and Screen Capturing:

            barindex
            Yara detected UrsnifShow sources
            Source: Yara matchFile source: 00000015.00000003.355232631.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314377890.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391622099.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314521084.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355592572.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314475815.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.367003924.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391468389.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370680495.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311090164.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313451317.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370551662.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391668872.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314245766.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391696489.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391496685.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355040596.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314318653.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311152381.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391727857.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311865061.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311345831.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391695930.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.311422020.0000000006CB8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001F.00000002.370336241.0000000006AE8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311203958.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.313929901.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311769510.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311540194.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.314268795.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355268021.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001B.00000002.361195316.00000000074A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391358945.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370621844.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311670564.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313872965.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391766298.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311984449.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.312268208.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.314181933.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391634804.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313395188.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366812647.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355464241.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366846077.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370930604.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000002.528368895.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.525372552.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311633818.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.328237107.0000000005588000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.526965041.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366987894.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370755681.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.346412042.0000000006C48000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370579660.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314563024.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355144752.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366907200.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391423871.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.354973566.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313701626.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391783104.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391671709.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366961006.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311364814.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366875687.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313576458.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311042721.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391794887.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370911517.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391520743.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311282599.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355518422.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.310694636.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391596036.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.314078107.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314146839.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311573394.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370793730.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.527384744.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.367026517.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 2880, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 3556, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5040, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 2624, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5352, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6276, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6536, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6708, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7000, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 1496, type: MEMORYSTR

            E-Banking Fraud:

            barindex
            Yara detected UrsnifShow sources
            Source: Yara matchFile source: 00000015.00000003.355232631.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314377890.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391622099.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314521084.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355592572.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314475815.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.367003924.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391468389.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370680495.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311090164.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313451317.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370551662.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391668872.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314245766.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391696489.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391496685.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355040596.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314318653.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311152381.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391727857.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311865061.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311345831.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391695930.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.311422020.0000000006CB8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001F.00000002.370336241.0000000006AE8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311203958.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.313929901.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311769510.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311540194.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.314268795.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355268021.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001B.00000002.361195316.00000000074A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391358945.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370621844.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311670564.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313872965.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391766298.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311984449.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.312268208.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.314181933.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391634804.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313395188.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366812647.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355464241.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366846077.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370930604.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000002.528368895.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.525372552.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311633818.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.328237107.0000000005588000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.526965041.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366987894.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370755681.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.346412042.0000000006C48000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370579660.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314563024.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355144752.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366907200.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391423871.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.354973566.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313701626.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391783104.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391671709.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366961006.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311364814.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.366875687.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.313576458.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311042721.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391794887.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370911517.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.391520743.0000000003138000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.311282599.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000015.00000003.355518422.0000000007528000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000003.310694636.00000000070D8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000003.391596036.0000000007088000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.314078107.0000000004C88000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.314146839.0000000006878000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.311573394.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000003.370793730.0000000004D98000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.527384744.0000000005538000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000022.00000003.367026517.00000000072A8000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 2880, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 3556, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5040, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 2624, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5352, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6276, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6536, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6708, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7000, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 1496, type: MEMORYSTR

            System Summary:

            barindex
            Writes or reads registry keys via WMIShow sources
            Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
            Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
            Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Writes registry values via WMIShow sources
            Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Re