Loading ...

Play interactive tourEdit tour

Windows Analysis Report pPX9DaPVYj

Overview

General Information

Sample Name:pPX9DaPVYj (renamed file extension from none to dll)
Analysis ID:528003
MD5:8b540033f4ffd79e5109e41a06f3e876
SHA1:86a8b94f1a3102ad3741fabccfe5ea5d9a3bf624
SHA256:2b3700c2a383b322dadfebfea00d9bc85b05a37793dc366954dd8c882f3006e2
Tags:dll
Infos:

Most interesting Screenshot:

Detection

Emotet
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Sigma detected: Emotet RunDLL32 Process Creation
Multi AV Scanner detection for domain / URL
Changes security center settings (notifications, updates, antivirus, firewall)
Machine Learning detection for sample
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
PE file contains an invalid checksum
PE file contains strange resources
Tries to load missing DLLs
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries disk information (often used to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 3748 cmdline: loaddll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)
    • cmd.exe (PID: 3012 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 4928 cmdline: rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • rundll32.exe (PID: 2680 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 4544 cmdline: rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • rundll32.exe (PID: 2848 cmdline: rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • rundll32.exe (PID: 1340 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
          • rundll32.exe (PID: 5192 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • svchost.exe (PID: 4820 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3372 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3272 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6092 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 68 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 1304 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 1020 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • MpCmdRun.exe (PID: 4664 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)
      • conhost.exe (PID: 4812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • svchost.exe (PID: 5964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 1000 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5272 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

Threatname: Emotet

{"Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"], "C2 list": ["51.178.61.60:443", "168.197.250.14:80", "45.79.33.48:8080", "196.44.98.190:8080", "177.72.80.14:7080", "51.210.242.234:8080", "185.148.169.10:8080", "142.4.219.173:8080", "78.47.204.80:443", "78.46.73.125:443", "37.44.244.177:8080", "37.59.209.141:8080", "191.252.103.16:80", "54.38.242.185:443", "85.214.67.203:8080", "54.37.228.122:443", "207.148.81.119:8080", "195.77.239.39:8080", "66.42.57.149:443", "195.154.146.35:443"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
    0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            11.3.rundll32.exe.3186e08.1.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              5.2.rundll32.exe.2aa6d88.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                6.3.rundll32.exe.3146c98.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  7.2.rundll32.exe.28b6cb8.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    11.2.rundll32.exe.3186e08.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      Click to see the 11 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Emotet RunDLL32 Process CreationShow sources
                      Source: Process startedAuthor: FPT.EagleEye: Data: Command: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL, CommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 1340, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL, ProcessId: 5192

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 6.2.rundll32.exe.3146c98.0.raw.unpackMalware Configuration Extractor: Emotet {"Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"], "C2 list": ["51.178.61.60:443", "168.197.250.14:80", "45.79.33.48:8080", "196.44.98.190:8080", "177.72.80.14:7080", "51.210.242.234:8080", "185.148.169.10:8080", "142.4.219.173:8080", "78.47.204.80:443", "78.46.73.125:443", "37.44.244.177:8080", "37.59.209.141:8080", "191.252.103.16:80", "54.38.242.185:443", "85.214.67.203:8080", "54.37.228.122:443", "207.148.81.119:8080", "195.77.239.39:8080", "66.42.57.149:443", "195.154.146.35:443"]}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: pPX9DaPVYj.dllVirustotal: Detection: 17%Perma Link
                      Source: pPX9DaPVYj.dllReversingLabs: Detection: 17%
                      Multi AV Scanner detection for domain / URLShow sources
                      Source: https://196.44.98.190/Virustotal: Detection: 10%Perma Link
                      Machine Learning detection for sampleShow sources
                      Source: pPX9DaPVYj.dllJoe Sandbox ML: detected
                      Source: 7.2.rundll32.exe.28b6cb8.0.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: pPX9DaPVYj.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                      Source: unknownHTTPS traffic detected: 51.178.61.60:443 -> 192.168.2.7:49751 version: TLS 1.2
                      Source: pPX9DaPVYj.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFC188A FindFirstFileExW,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFC188A FindFirstFileExW,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10011A80 FindFirstFileW,

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2404334 ET CNC Feodo Tracker Reported CnC Server TCP group 18 192.168.2.7:49751 -> 51.178.61.60:443
                      Source: TrafficSnort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.7:49752 -> 168.197.250.14:80
                      Source: TrafficSnort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.7:49753 -> 45.79.33.48:8080
                      Source: TrafficSnort IDS: 2404322 ET CNC Feodo Tracker Reported CnC Server TCP group 12 192.168.2.7:49757 -> 196.44.98.190:8080
                      Source: TrafficSnort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.7:49772 -> 177.72.80.14:7080
                      Source: TrafficSnort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 177.72.80.14:7080 -> 192.168.2.7:49772
                      System process connects to network (likely due to code injection or exploit)Show sources
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 196.44.98.190 144
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 45.79.33.48 144
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 168.197.250.14 80
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 51.178.61.60 187
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 177.72.80.14 168
                      C2 URLs / IPs found in malware configurationShow sources
                      Source: Malware configuration extractorIPs: 51.178.61.60:443
                      Source: Malware configuration extractorIPs: 168.197.250.14:80
                      Source: Malware configuration extractorIPs: 45.79.33.48:8080
                      Source: Malware configuration extractorIPs: 196.44.98.190:8080
                      Source: Malware configuration extractorIPs: 177.72.80.14:7080
                      Source: Malware configuration extractorIPs: 51.210.242.234:8080
                      Source: Malware configuration extractorIPs: 185.148.169.10:8080
                      Source: Malware configuration extractorIPs: 142.4.219.173:8080
                      Source: Malware configuration extractorIPs: 78.47.204.80:443
                      Source: Malware configuration extractorIPs: 78.46.73.125:443
                      Source: Malware configuration extractorIPs: 37.44.244.177:8080
                      Source: Malware configuration extractorIPs: 37.59.209.141:8080
                      Source: Malware configuration extractorIPs: 191.252.103.16:80
                      Source: Malware configuration extractorIPs: 54.38.242.185:443
                      Source: Malware configuration extractorIPs: 85.214.67.203:8080
                      Source: Malware configuration extractorIPs: 54.37.228.122:443
                      Source: Malware configuration extractorIPs: 207.148.81.119:8080
                      Source: Malware configuration extractorIPs: 195.77.239.39:8080
                      Source: Malware configuration extractorIPs: 66.42.57.149:443
                      Source: Malware configuration extractorIPs: 195.154.146.35:443
                      Source: Joe Sandbox ViewASN Name: AS-CHOOPAUS AS-CHOOPAUS
                      Source: Joe Sandbox ViewASN Name: EcobandGH EcobandGH
                      Source: Joe Sandbox ViewJA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
                      Source: global trafficHTTP traffic detected: GET /euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK HTTP/1.1Cookie: VkztqiHrcfJdN=ApwlpkLXHikt80ZX+rUy7QNus1UrOzvArQ2wT9a3pzG/LUBUBtVLGWZUvhWo++76HscbZaar1ecNJ2NE9drzI+WYO0CrHXBK96gsrw5gCDv1H6FDJl4E1ekAk6rTT5+tRKnKwaubeNjES2yzAZ1ahqbQap+ahvLDVY0Qeg8dZyFp/mT2xfuy2YrZ9Y4gh8SdNUmOMTIzF7OqgRdAc+m0GdjTDMrrOF8BD44A4Z4RsQ0CT4V3SWcXRNU/sbnThRJ79M/3w70CfUdRJu8qNans8M5bB4RoXwYtmb2k0+VOyCLBxVpjHost: 51.178.61.60Connection: Keep-AliveCache-Control: no-cache
                      Source: Joe Sandbox ViewIP Address: 207.148.81.119 207.148.81.119
                      Source: Joe Sandbox ViewIP Address: 196.44.98.190 196.44.98.190
                      Source: global trafficTCP traffic: 192.168.2.7:49753 -> 45.79.33.48:8080
                      Source: global trafficTCP traffic: 192.168.2.7:49757 -> 196.44.98.190:8080
                      Source: global trafficTCP traffic: 192.168.2.7:49772 -> 177.72.80.14:7080
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
                      Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Nov 2021 15:52:19 GMTContent-Type: text/htmlContent-Length: 162Connection: close
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 51.178.61.60
                      Source: unknownTCP traffic detected without corresponding DNS query: 168.197.250.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 168.197.250.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 168.197.250.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 45.79.33.48
                      Source: unknownTCP traffic detected without corresponding DNS query: 45.79.33.48
                      Source: unknownTCP traffic detected without corresponding DNS query: 45.79.33.48
                      Source: unknownTCP traffic detected without corresponding DNS query: 196.44.98.190
                      Source: unknownTCP traffic detected without corresponding DNS query: 196.44.98.190
                      Source: unknownTCP traffic detected without corresponding DNS query: 196.44.98.190
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: unknownTCP traffic detected without corresponding DNS query: 177.72.80.14
                      Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.facebook.com (Facebook)
                      Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.twitter.com (Twitter)
                      Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.391812241.000001961E19B000.00000004.00000001.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-23T19:02:05.3195648Z||.||797d024d-8c74-4faa-b6a6-08435801478b||1152921505694213184||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
                      Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.391812241.000001961E19B000.00000004.00000001.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-23T19:02:05.3195648Z||.||797d024d-8c74-4faa-b6a6-08435801478b||1152921505694213184||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
                      Source: svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.278820009.00000000031DD000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.407621482.000001961E10B000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.408682546.000001961E10C000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmpString found in binary or memory: http://crl.ver)
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                      Source: rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.11.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                      Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpString found in binary or memory: http://help.disneyplus.com.
                      Source: svchost.exe, 00000008.00000002.604454697.000001E15A2B1000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.603917359.000001E15A2B1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
                      Source: svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmpString found in binary or memory: http://www.bingmapsportal.com
                      Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
                      Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpString found in binary or memory: https://%s.xboxlive.com
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://168.197.250.14/
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpString found in binary or memory: https://168.197.250.14/AR1B
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://168.197.250.14/HR
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://168.197.250.14:80/ctsONulME
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpString found in binary or memory: https://168.197.250.14:80/z
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://177.72.80.14/
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://177.72.80.14/ZR8B
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://177.72.80.14:7080/iWFUUeWljUhVsRHEOKBBOqGWSiJFZYkHnHENgHC
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://196.44.98.190/
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://196.44.98.190:8080/fRmCLCTmnCqbhnJwguPmnKiWalLOGONSERVER=
                      Source: rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48/
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48:8080/
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48:8080/J
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx5E4AB229
                      Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcxL
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48:8080/b
                      Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpString found in binary or memory: https://45.79.33.48:8080/cx
                      Source: rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmpString found in binary or memory: https://51.178.61.60/
                      Source: rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmpString found in binary or memory: https://51.178.61.60/20
                      Source: rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmpString found in binary or memory: https://51.178.61.60/euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK
                      Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpString found in binary or memory: https://activity.windows.com
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
                      Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
                      Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
                      Source: svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
                      Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
                      Source: svchost.exe, 0000000F.00000003.307634342.0000025B4EE51000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.308016792.0000025B4EE55000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
                      Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
                      Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
                      Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
                      Source: svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
                      Source: svchost.exe, 0000000F.00000002.307997677.0000025B4EE42000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307709990.0000025B4EE41000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
                      Source: svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
                      Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpString found in binary or memory: https://disneyplus.com/legal.
                      Source: svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
                      Source: svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
                      Source: svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
                      Source: svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.t
                      Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
                      Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
                      Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
                      Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
                      Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
                      Source: svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
                      Source: svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
                      Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
                      Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307722267.0000025B4EE39000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
                      Source: svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
                      Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
                      Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
                      Source: svchost.exe, 00000018.00000003.387694664.000001961E176000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.387711669.000001961E187000.00000004.00000001.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10021027 InternetReadFile,
                      Source: global trafficHTTP traffic detected: GET /euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK HTTP/1.1Cookie: VkztqiHrcfJdN=ApwlpkLXHikt80ZX+rUy7QNus1UrOzvArQ2wT9a3pzG/LUBUBtVLGWZUvhWo++76HscbZaar1ecNJ2NE9drzI+WYO0CrHXBK96gsrw5gCDv1H6FDJl4E1ekAk6rTT5+tRKnKwaubeNjES2yzAZ1ahqbQap+ahvLDVY0Qeg8dZyFp/mT2xfuy2YrZ9Y4gh8SdNUmOMTIzF7OqgRdAc+m0GdjTDMrrOF8BD44A4Z4RsQ0CT4V3SWcXRNU/sbnThRJ79M/3w70CfUdRJu8qNans8M5bB4RoXwYtmb2k0+VOyCLBxVpjHost: 51.178.61.60Connection: Keep-AliveCache-Control: no-cache
                      Source: unknownHTTPS traffic detected: 51.178.61.60:443 -> 192.168.2.7:49751 version: TLS 1.2
                      Source: loaddll32.exe, 00000001.00000002.261078261.0000000000FEB000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      E-Banking Fraud:

                      barindex
                      Yara detected EmotetShow sources
                      Source: Yara matchFile source: 11.3.rundll32.exe.3186e08.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.2aa6d88.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.3.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.rundll32.exe.28b6cb8.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.rundll32.exe.3186e08.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.2aa6d88.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.3.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.3.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.3.rundll32.exe.3186e08.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 9.2.rundll32.exe.2eb6e00.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.3.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 9.2.rundll32.exe.2eb6e00.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000003.513585241.0000000003173000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000003.328562700.0000000003173000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000003.258124529.00000000028B6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000009.00000002.264342755.0000000002EB6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000003.278848660.0000000003173000.00000004.00000001.sdmp, type: MEMORY

                      System Summary:

                      barindex
                      Source: pPX9DaPVYj.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                      Source: C:\Windows\SysWOW64\rundll32.exeFile deleted: C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem:Zone.IdentifierJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\SysWOW64\Vjqsuducipqiide\Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBB2B0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBBB30
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFB9F20
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBB080
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFC6564
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBBB30
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBB2B0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFB9F20
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBB080
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFC6564
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000441E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001CAA8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100143B3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10004C00
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10008C09
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10011C10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000F41F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000EC27
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000943C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001F83F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001E441
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10002043
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10003845
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000A048
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001406E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10001C76
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001748A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000CC8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001D091
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10003C91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000AC95
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001AC9B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100178A5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100198BD
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100208D1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001CCD4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001ECE3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001A8F0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100030F6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10003502
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001FD10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000251C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10005923
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1002292B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001F14D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000C158
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001056A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10014D8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10021193
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000FD91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001D99A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10019DA1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001B1B5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100225C3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100055E8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000C5FE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10001A0A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000220A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000E21C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10015220
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10009E22
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000D223
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10021A3C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10002A46
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10002654
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10009A57
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10007283
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10020687
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10014E8A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000FEA0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001D6A7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000DAAE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100166BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001BEC9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10010ADE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001AEEB
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001DEF4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10002309
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10006B25
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10016726
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10020B34
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10021343
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10003345
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10003F5C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10004F8E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001B397
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10014BA4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10014BAA
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10017BB2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000BFB6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10006FC4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1000A3DF
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001BFE8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_100203F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10004C00
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000441E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000F41F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000943C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10002043
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10003845
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10002A46
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001CAA8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100208D1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001ECE3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001AEEB
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001DEF4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001056A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001D99A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10017BB2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10008C09
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10001A0A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000220A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10011C10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000E21C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10015220
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10009E22
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000D223
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000EC27
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10021A3C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001F83F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001E441
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000A048
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10002654
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10009A57
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001406E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10001C76
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10007283
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10020687
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10014E8A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001748A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000CC8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001D091
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10003C91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000AC95
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001AC9B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000FEA0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100178A5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001D6A7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000DAAE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100198BD
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100166BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001BEC9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001CCD4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10010ADE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001A8F0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100030F6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10003502
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10002309
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001FD10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000251C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10005923
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10006B25
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10016726
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1002292B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10020B34
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10021343
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10003345
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001F14D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000C158
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10003F5C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10009384
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10014D8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10004F8E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10021193
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000FD91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001B397
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10019DA1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10012FA2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10014BA4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10014BAA
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100143B3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001B1B5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000BFB6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100225C3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10006FC4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000A3DF
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100055E8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001BFE8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_100203F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1000C5FE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10004C00
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000441E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000943C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10003845
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10002A46
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100208D1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001ECE3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001AEEB
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001DEF4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001D99A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10017BB2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10008C09
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10001A0A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000220A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10011C10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000E21C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000F41F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10015220
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10009E22
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000D223
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000EC27
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10021A3C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001F83F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001E441
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10002043
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000A048
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10002654
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10009A57
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001406E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10001C76
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10007283
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10020687
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10014E8A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001748A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000CC8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001D091
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10003C91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000AC95
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001AC9B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000FEA0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100178A5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001D6A7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001CAA8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000DAAE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100198BD
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100166BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001BEC9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001CCD4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10010ADE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001A8F0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100030F6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100194F7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10003502
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10002309
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001FD10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000251C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10005923
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10006B25
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10016726
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1002292B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10020B34
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10021343
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10003345
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001F14D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000C158
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10003F5C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10011F6B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001056A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10009384
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10014D8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10004F8E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10021193
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000FD91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001B397
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10019DA1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10012FA2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10014BA4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10014BAA
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100143B3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001B1B5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000BFB6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100225C3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10006FC4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000A3DF
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100055E8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001BFE8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100203F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000C5FE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000441E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001CAA8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100143B3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10004C00
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10008C09
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10001A0A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000220A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10011C10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000E21C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000F41F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10015220
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10009E22
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000D223
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000EC27
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000943C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10021A3C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001F83F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001E441
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10002043
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10003845
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10002A46
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000A048
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10002654
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10009A57
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001406E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10001C76
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10007283
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10020687
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10014E8A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001748A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000CC8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001D091
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10003C91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000AC95
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001AC9B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000FEA0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100178A5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001D6A7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000DAAE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100198BD
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100166BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001BEC9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100208D1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001CCD4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10010ADE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001ECE3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001AEEB
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001A8F0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001DEF4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100030F6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100194F7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10003502
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10002309
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001FD10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000251C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10005923
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10006B25
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10016726
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1002292B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10020B34
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10021343
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10003345
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001F14D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000C158
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10003F5C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10011F6B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001056A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10014D8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10004F8E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10021193
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000FD91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001B397
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001D99A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10019DA1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10014BA4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10014BAA
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10017BB2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001B1B5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000BFB6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100225C3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10006FC4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000A3DF
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100055E8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001BFE8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_100203F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1000C5FE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000220A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000441E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10015220
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000EC27
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000943C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001F83F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10002043
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10003845
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001748A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000AC95
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100178A5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100208D1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001ECE3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001DEF4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100030F6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10020B34
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100131A6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10014BAA
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000BFB6
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100147BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10006FC4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100055E8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100203F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000C5FE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10004C00
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10008C09
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10001A0A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10011C10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000E21C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000F41F
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10009E22
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000D223
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10021A3C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001E441
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10002A46
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000A048
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10002654
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10009A57
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001406E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10001C76
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10007283
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10020687
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10014E8A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000CC8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001D091
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10003C91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001AC9B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000FEA0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001D6A7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001CAA8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000DAAE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10005AB2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100198BD
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100166BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001BEC9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001CCD4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10010ADE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001AEEB
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001A8F0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100194F7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10003502
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10002309
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001FD10
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000251C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10005923
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10006B25
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10016726
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1002292B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10021343
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10003345
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001F14D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000C158
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10003F5C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10011F6B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001056A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10009384
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10014D8D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10004F8E
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10021193
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000FD91
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001B397
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001D99A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10019DA1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10012FA2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100143B3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10017BB2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001B1B5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_100225C3
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1000A3DF
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001BFE8
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 6EFBD020 appears 48 times
                      Source: pPX9DaPVYj.dllStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: pPX9DaPVYj.dllStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dll
                      Source: pPX9DaPVYj.dllVirustotal: Detection: 17%
                      Source: pPX9DaPVYj.dllReversingLabs: Detection: 17%
                      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll"
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
                      Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                      Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL
                      Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                      Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
                      Source: classification engineClassification label: mal100.troj.evad.winDLL@28/9@0/22
                      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10011B54 CreateToolhelp32Snapshot,
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                      Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\7ce3e80173264ea19b05306b865eadf9
                      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4812:120:WilError_01
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: pPX9DaPVYj.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                      Source: pPX9DaPVYj.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                      Source: pPX9DaPVYj.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                      Source: pPX9DaPVYj.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: pPX9DaPVYj.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                      Source: pPX9DaPVYj.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                      Source: pPX9DaPVYj.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                      Source: pPX9DaPVYj.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: pPX9DaPVYj.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                      Source: pPX9DaPVYj.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                      Source: pPX9DaPVYj.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                      Source: pPX9DaPVYj.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                      Source: pPX9DaPVYj.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFABAD4 push ebx; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFAC7C9 push esi; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFA9C81 push eax; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBD066 push ecx; ret
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFACDEB push esp; ret
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFA5DD9 push eax; ret
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFAAD03 push esi; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFABAD4 push ebx; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFAC7C9 push esi; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFA9C81 push eax; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBD066 push ecx; ret
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFACDEB push esp; ret
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFA5DD9 push eax; ret
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFAAD03 push esi; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10016134 push edi; retf 0040h
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_10001229 push eax; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001475A pushfd ; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10001229 push eax; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_10016134 push edi; retf 0040h
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001475A pushfd ; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10001229 push eax; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10016134 push edi; retf 0040h
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001475A pushfd ; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10001229 push eax; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_10016134 push edi; retf 0040h
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001475A pushfd ; iretd
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10001229 push eax; retf
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10016134 push edi; retf 0040h
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001475A pushfd ; iretd
                      Source: pPX9DaPVYj.dllStatic PE information: section name: .flat
                      Source: pPX9DaPVYj.dllStatic PE information: real checksum: 0x748e8 should be: 0x6f1c8
                      Source: C:\Windows\SysWOW64\rundll32.exePE file moved: C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oemJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
                      Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem:Zone.Identifier read attributes | delete
                      Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Windows\SysWOW64\Unedamop\kyuonpy.jno:Zone.Identifier read attributes | delete
                      Source: C:\Windows\System32\svchost.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\svchost.exe TID: 1976Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 1976Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 5124Thread sleep time: -120000s >= -30000s
                      Source: C:\Windows\System32\loaddll32.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFC188A FindFirstFileExW,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFC188A FindFirstFileExW,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_10011A80 FindFirstFileW,
                      Source: C:\Windows\SysWOW64\rundll32.exeFile Volume queried: C:\ FullSizeInformation
                      Source: svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmpBinary or memory string: "@Hyper-V RAW
                      Source: svchost.exe, 00000008.00000002.604276820.000001E15A229000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.604674665.000001E15FA4C000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.408537691.000001961DAE7000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
                      Source: svchost.exe, 00000018.00000002.408420499.000001961DA6F000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
                      Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.777791842.0000020FCF829000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBCEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBC280 GetProcessHeap,HeapFree,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFC14AE mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBF416 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFC14AE mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBF416 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_1001DE10 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_1001DE10 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001DE10 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 9_2_1001DE10 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 11_2_1001DE10 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPort
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBCEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBC66F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBFF39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBCEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBC66F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_6EFBFF39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      System process connects to network (likely due to code injection or exploit)Show sources
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 196.44.98.190 144
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 45.79.33.48 144
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 168.197.250.14 80
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 51.178.61.60 187
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 177.72.80.14 168
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                      Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmpBinary or memory string: uProgram Manager
                      Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBD07B cpuid
                      Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_6EFBCAD3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

                      Lowering of HIPS / PFW / Operating System Security Settings:

                      barindex
                      Changes security center settings (notifications, updates, antivirus, firewall)Show sources
                      Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
                      Source: svchost.exe, 00000011.00000002.777866733.000001FDB4902000.00000004.00000001.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected EmotetShow sources
                      Source: Yara matchFile source: 11.3.rundll32.exe.3186e08.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.2aa6d88.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.3.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.rundll32.exe.28b6cb8.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.rundll32.exe.3186e08.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.2aa6d88.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.3.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.3.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.3.rundll32.exe.3186e08.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 9.2.rundll32.exe.2eb6e00.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.3.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 9.2.rundll32.exe.2eb6e00.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000003.513585241.0000000003173000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000003.328562700.0000000003173000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000003.258124529.00000000028B6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000009.00000002.264342755.0000000002EB6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000003.278848660.0000000003173000.00000004.00000001.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation1DLL Side-Loading1DLL Side-Loading1Disable or Modify Tools1Input Capture1System Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumIngress Tool Transfer4Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsProcess Injection112Deobfuscate/Decode Files or Information1LSASS MemoryFile and Directory Discovery2Remote Desktop ProtocolInput Capture1Exfiltration Over BluetoothEncrypted Channel11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerSystem Information Discovery34SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Standard Port1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing1NTDSQuery Registry1Distributed Component Object ModelInput CaptureScheduled TransferNon-Application Layer Protocol2SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsSecurity Software Discovery61SSHKeyloggingData Transfer Size LimitsApplication Layer Protocol13Manipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonFile Deletion1Cached Domain CredentialsVirtualization/Sandbox Evasion3VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsMasquerading2DCSyncProcess Discovery2Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobVirtualization/Sandbox Evasion3Proc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Process Injection112/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Hidden Files and Directories1Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                      Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRundll321Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 528003 Sample: pPX9DaPVYj Startdate: 24/11/2021 Architecture: WINDOWS Score: 100 42 85.214.67.203 STRATOSTRATOAGDE Germany 2->42 44 195.154.146.35 OnlineSASFR France 2->44 46 13 other IPs or domains 2->46 58 Sigma detected: Emotet RunDLL32 Process Creation 2->58 60 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->60 62 Multi AV Scanner detection for domain / URL 2->62 64 5 other signatures 2->64 10 loaddll32.exe 1 2->10         started        12 svchost.exe 2->12         started        15 svchost.exe 9 1 2->15         started        18 8 other processes 2->18 signatures3 process4 dnsIp5 20 rundll32.exe 10->20         started        22 cmd.exe 1 10->22         started        72 Changes security center settings (notifications, updates, antivirus, firewall) 12->72 24 MpCmdRun.exe 1 12->24         started        54 127.0.0.1 unknown unknown 15->54 56 192.168.2.1 unknown unknown 18->56 signatures6 process7 process8 26 rundll32.exe 2 20->26         started        29 rundll32.exe 22->29         started        31 conhost.exe 24->31         started        signatures9 70 Hides that the sample has been downloaded from the Internet (zone.identifier) 26->70 33 rundll32.exe 26->33         started        35 rundll32.exe 2 29->35         started        process10 signatures11 38 rundll32.exe 12 33->38         started        66 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->66 process12 dnsIp13 48 168.197.250.14, 49752, 80 OmarAnselmoRipollTDCNETAR Argentina 38->48 50 51.178.61.60, 443, 49751 OVHFR France 38->50 52 3 other IPs or domains 38->52 68 System process connects to network (likely due to code injection or exploit) 38->68 signatures14

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      pPX9DaPVYj.dll17%VirustotalBrowse
                      pPX9DaPVYj.dll18%ReversingLabsWin32.Trojan.Mansabo
                      pPX9DaPVYj.dll100%Joe Sandbox ML

                      Dropped Files

                      No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      9.2.rundll32.exe.10000000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      11.3.rundll32.exe.3186e08.2.unpack100%AviraHEUR/AGEN.1110387Download File
                      11.3.rundll32.exe.3186e08.1.unpack100%AviraHEUR/AGEN.1110387Download File
                      7.2.rundll32.exe.28b6cb8.0.unpack100%AviraTR/ATRAPS.GenDownload File
                      11.3.rundll32.exe.3186e08.0.unpack100%AviraHEUR/AGEN.1110387Download File
                      5.2.rundll32.exe.10000000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      7.2.rundll32.exe.10000000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      11.2.rundll32.exe.10000000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                      6.2.rundll32.exe.10000000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcxL0%Avira URL Cloudsafe
                      https://168.197.250.14:80/ctsONulME0%Avira URL Cloudsafe
                      https://196.44.98.190/11%VirustotalBrowse
                      https://196.44.98.190/0%Avira URL Cloudsafe
                      https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx0%Avira URL Cloudsafe
                      https://168.197.250.14/AR1B0%Avira URL Cloudsafe
                      https://51.178.61.60/0%Avira URL Cloudsafe
                      https://51.178.61.60/euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK0%Avira URL Cloudsafe
                      https://177.72.80.14/ZR8B0%Avira URL Cloudsafe
                      https://196.44.98.190:8080/fRmCLCTmnCqbhnJwguPmnKiWalLOGONSERVER=0%Avira URL Cloudsafe
                      https://168.197.250.14/0%Avira URL Cloudsafe
                      https://177.72.80.14:7080/iWFUUeWljUhVsRHEOKBBOqGWSiJFZYkHnHENgHC0%Avira URL Cloudsafe
                      https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
                      https://168.197.250.14/HR0%Avira URL Cloudsafe
                      https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx5E4AB2290%Avira URL Cloudsafe
                      https://51.178.61.60/200%Avira URL Cloudsafe
                      http://crl.ver)0%Avira URL Cloudsafe
                      https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
                      https://%s.xboxlive.com0%URL Reputationsafe
                      https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
                      https://dynamic.t0%URL Reputationsafe
                      https://disneyplus.com/legal.0%URL Reputationsafe
                      http://help.disneyplus.com.0%URL Reputationsafe
                      https://%s.dnet.xboxlive.com0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://51.178.61.60/euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiKtrue
                      • Avira URL Cloud: safe
                      unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpfalse
                        high
                        https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcxLrundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                          high
                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpfalse
                            high
                            https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmpfalse
                              high
                              https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                                high
                                https://168.197.250.14:80/ctsONulMErundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                https://196.44.98.190/rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmptrue
                                • 11%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                unknown
                                https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcxrundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 0000000F.00000002.307997677.0000025B4EE42000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307709990.0000025B4EE41000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmpfalse
                                  high
                                  https://168.197.250.14/AR1Brundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                                    high
                                    https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpfalse
                                      high
                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpfalse
                                        high
                                        https://51.178.61.60/rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmpfalse
                                          high
                                          https://177.72.80.14/ZR8Brundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://196.44.98.190:8080/fRmCLCTmnCqbhnJwguPmnKiWalLOGONSERVER=rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://168.197.250.14/rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://www.bingmapsportal.comsvchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmpfalse
                                            high
                                            https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpfalse
                                              high
                                              https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                                                high
                                                https://177.72.80.14:7080/iWFUUeWljUhVsRHEOKBBOqGWSiJFZYkHnHENgHCrundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://www.disneyplus.com/legal/your-california-privacy-rightssvchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                unknown
                                                https://168.197.250.14/HRrundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmpfalse
                                                  high
                                                  https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx5E4AB229rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://51.178.61.60/20rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmpfalse
                                                    high
                                                    https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpfalse
                                                      high
                                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmpfalse
                                                        high
                                                        http://crl.ver)svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        low
                                                        https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpfalse
                                                          high
                                                          https://www.tiktok.com/legal/report/feedbacksvchost.exe, 00000018.00000003.387694664.000001961E176000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.387711669.000001961E187000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmpfalse
                                                            high
                                                            https://177.72.80.14/rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                                              unknown
                                                              https://%s.xboxlive.comsvchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              low
                                                              https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000F.00000003.307634342.0000025B4EE51000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.308016792.0000025B4EE55000.00000004.00000001.sdmpfalse
                                                                high
                                                                https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                                                                  high
                                                                  https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpfalse
                                                                    high
                                                                    https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                                                                      high
                                                                      https://168.197.250.14:80/zrundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpfalse
                                                                        unknown
                                                                        https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpfalse
                                                                          high
                                                                          https://www.disneyplus.com/legal/privacy-policysvchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          unknown
                                                                          https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmpfalse
                                                                            high
                                                                            http://schemas.xmlsoap.org/ws/2004/08/addressingsvchost.exe, 00000008.00000002.604454697.000001E15A2B1000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.603917359.000001E15A2B1000.00000004.00000001.sdmpfalse
                                                                              high
                                                                              https://45.79.33.48:8080/Jrundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpfalse
                                                                                unknown
                                                                                https://dynamic.tsvchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://45.79.33.48/rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmpfalse
                                                                                  unknown
                                                                                  https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                                                                                    high
                                                                                    https://disneyplus.com/legal.svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    unknown
                                                                                    https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307722267.0000025B4EE39000.00000004.00000001.sdmpfalse
                                                                                      high
                                                                                      https://45.79.33.48:8080/rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpfalse
                                                                                        unknown
                                                                                        https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpfalse
                                                                                          high
                                                                                          https://45.79.33.48:8080/cxrundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpfalse
                                                                                            unknown
                                                                                            https://activity.windows.comsvchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpfalse
                                                                                              high
                                                                                              https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmpfalse
                                                                                                high
                                                                                                http://help.disneyplus.com.svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmpfalse
                                                                                                • URL Reputation: safe
                                                                                                unknown
                                                                                                https://%s.dnet.xboxlive.comsvchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmpfalse
                                                                                                • URL Reputation: safe
                                                                                                low
                                                                                                https://45.79.33.48:8080/brundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmpfalse
                                                                                                  unknown
                                                                                                  https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmpfalse
                                                                                                    high

                                                                                                    Contacted IPs

                                                                                                    • No. of IPs < 25%
                                                                                                    • 25% < No. of IPs < 50%
                                                                                                    • 50% < No. of IPs < 75%
                                                                                                    • 75% < No. of IPs

                                                                                                    Public

                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                    207.148.81.119
                                                                                                    unknownUnited States
                                                                                                    20473AS-CHOOPAUStrue
                                                                                                    196.44.98.190
                                                                                                    unknownGhana
                                                                                                    327814EcobandGHtrue
                                                                                                    78.46.73.125
                                                                                                    unknownGermany
                                                                                                    24940HETZNER-ASDEtrue
                                                                                                    37.59.209.141
                                                                                                    unknownFrance
                                                                                                    16276OVHFRtrue
                                                                                                    85.214.67.203
                                                                                                    unknownGermany
                                                                                                    6724STRATOSTRATOAGDEtrue
                                                                                                    191.252.103.16
                                                                                                    unknownBrazil
                                                                                                    27715LocawebServicosdeInternetSABRtrue
                                                                                                    45.79.33.48
                                                                                                    unknownUnited States
                                                                                                    63949LINODE-APLinodeLLCUStrue
                                                                                                    54.37.228.122
                                                                                                    unknownFrance
                                                                                                    16276OVHFRtrue
                                                                                                    185.148.169.10
                                                                                                    unknownGermany
                                                                                                    44780EVERSCALE-ASDEtrue
                                                                                                    142.4.219.173
                                                                                                    unknownCanada
                                                                                                    16276OVHFRtrue
                                                                                                    54.38.242.185
                                                                                                    unknownFrance
                                                                                                    16276OVHFRtrue
                                                                                                    195.154.146.35
                                                                                                    unknownFrance
                                                                                                    12876OnlineSASFRtrue
                                                                                                    195.77.239.39
                                                                                                    unknownSpain
                                                                                                    60493FICOSA-ASEStrue
                                                                                                    78.47.204.80
                                                                                                    unknownGermany
                                                                                                    24940HETZNER-ASDEtrue
                                                                                                    168.197.250.14
                                                                                                    unknownArgentina
                                                                                                    264776OmarAnselmoRipollTDCNETARtrue
                                                                                                    51.178.61.60
                                                                                                    unknownFrance
                                                                                                    16276OVHFRtrue
                                                                                                    177.72.80.14
                                                                                                    unknownBrazil
                                                                                                    262543NewLifeFibraBRtrue
                                                                                                    66.42.57.149
                                                                                                    unknownUnited States
                                                                                                    20473AS-CHOOPAUStrue
                                                                                                    37.44.244.177
                                                                                                    unknownGermany
                                                                                                    47583AS-HOSTINGERLTtrue
                                                                                                    51.210.242.234
                                                                                                    unknownFrance
                                                                                                    16276OVHFRtrue

                                                                                                    Private

                                                                                                    IP
                                                                                                    192.168.2.1
                                                                                                    127.0.0.1

                                                                                                    General Information

                                                                                                    Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                                    Analysis ID:528003
                                                                                                    Start date:24.11.2021
                                                                                                    Start time:16:51:05
                                                                                                    Joe Sandbox Product:CloudBasic
                                                                                                    Overall analysis duration:0h 14m 19s
                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                    Report type:light
                                                                                                    Sample file name:pPX9DaPVYj (renamed file extension from none to dll)
                                                                                                    Cookbook file name:default.jbs
                                                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                    Number of analysed new started processes analysed:33
                                                                                                    Number of new started drivers analysed:0
                                                                                                    Number of existing processes analysed:0
                                                                                                    Number of existing drivers analysed:0
                                                                                                    Number of injected processes analysed:0
                                                                                                    Technologies:
                                                                                                    • HCA enabled
                                                                                                    • EGA enabled
                                                                                                    • HDC enabled
                                                                                                    • AMSI enabled
                                                                                                    Analysis Mode:default
                                                                                                    Analysis stop reason:Timeout
                                                                                                    Detection:MAL
                                                                                                    Classification:mal100.troj.evad.winDLL@28/9@0/22
                                                                                                    EGA Information:Failed
                                                                                                    HDC Information:
                                                                                                    • Successful, ratio: 76.9% (good quality ratio 67.6%)
                                                                                                    • Quality average: 69.9%
                                                                                                    • Quality standard deviation: 32.3%
                                                                                                    HCA Information:
                                                                                                    • Successful, ratio: 95%
                                                                                                    • Number of executed functions: 0
                                                                                                    • Number of non-executed functions: 0
                                                                                                    Cookbook Comments:
                                                                                                    • Adjust boot time
                                                                                                    • Enable AMSI
                                                                                                    • Override analysis time to 240s for rundll32
                                                                                                    Warnings:
                                                                                                    Show All
                                                                                                    • Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, wuapihost.exe
                                                                                                    • Excluded IPs from analysis (whitelisted): 23.54.113.53, 23.35.236.56, 173.222.108.226, 173.222.108.210, 20.54.110.249
                                                                                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                    Simulations

                                                                                                    Behavior and APIs

                                                                                                    TimeTypeDescription
                                                                                                    16:52:10API Interceptor10x Sleep call for process: svchost.exe modified
                                                                                                    16:53:26API Interceptor1x Sleep call for process: MpCmdRun.exe modified

                                                                                                    Joe Sandbox View / Context

                                                                                                    IPs

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                    207.148.81.119cRC6TZG6Wx.dllGet hashmaliciousBrowse
                                                                                                      qrb6jVwzoe.dllGet hashmaliciousBrowse
                                                                                                        1711.docGet hashmaliciousBrowse
                                                                                                          GQwxmGZFvtg.dllGet hashmaliciousBrowse
                                                                                                            wNjqkrm8pH.dllGet hashmaliciousBrowse
                                                                                                              5YO8hZg21O.dllGet hashmaliciousBrowse
                                                                                                                dUGnMYeP1C.dllGet hashmaliciousBrowse
                                                                                                                  yFAXc9z51V.dllGet hashmaliciousBrowse
                                                                                                                    9fC0as7YLE.dllGet hashmaliciousBrowse
                                                                                                                      FIyE6huzxV.dllGet hashmaliciousBrowse
                                                                                                                        V0gZWRXv8d.dllGet hashmaliciousBrowse
                                                                                                                          t5EuQW2GUF.dllGet hashmaliciousBrowse
                                                                                                                            uh1WyesPlh.dllGet hashmaliciousBrowse
                                                                                                                              8rryPzJR1p.dllGet hashmaliciousBrowse
                                                                                                                                a65FgjVus4.dllGet hashmaliciousBrowse
                                                                                                                                  bWjYh6H8wk.dllGet hashmaliciousBrowse
                                                                                                                                    ZJOHKItBoJ.dllGet hashmaliciousBrowse
                                                                                                                                      eyPPiz3W6u.dllGet hashmaliciousBrowse
                                                                                                                                        HjYSwxqyUn.dllGet hashmaliciousBrowse
                                                                                                                                          f47YPsvRI3.dllGet hashmaliciousBrowse
                                                                                                                                            196.44.98.190cRC6TZG6Wx.dllGet hashmaliciousBrowse
                                                                                                                                              qrb6jVwzoe.dllGet hashmaliciousBrowse
                                                                                                                                                1711.docGet hashmaliciousBrowse
                                                                                                                                                  GQwxmGZFvtg.dllGet hashmaliciousBrowse
                                                                                                                                                    wNjqkrm8pH.dllGet hashmaliciousBrowse
                                                                                                                                                      5YO8hZg21O.dllGet hashmaliciousBrowse
                                                                                                                                                        dUGnMYeP1C.dllGet hashmaliciousBrowse
                                                                                                                                                          yFAXc9z51V.dllGet hashmaliciousBrowse
                                                                                                                                                            9fC0as7YLE.dllGet hashmaliciousBrowse
                                                                                                                                                              FIyE6huzxV.dllGet hashmaliciousBrowse
                                                                                                                                                                V0gZWRXv8d.dllGet hashmaliciousBrowse
                                                                                                                                                                  t5EuQW2GUF.dllGet hashmaliciousBrowse
                                                                                                                                                                    uh1WyesPlh.dllGet hashmaliciousBrowse
                                                                                                                                                                      8rryPzJR1p.dllGet hashmaliciousBrowse
                                                                                                                                                                        a65FgjVus4.dllGet hashmaliciousBrowse
                                                                                                                                                                          bWjYh6H8wk.dllGet hashmaliciousBrowse
                                                                                                                                                                            ZJOHKItBoJ.dllGet hashmaliciousBrowse
                                                                                                                                                                              eyPPiz3W6u.dllGet hashmaliciousBrowse
                                                                                                                                                                                HjYSwxqyUn.dllGet hashmaliciousBrowse
                                                                                                                                                                                  f47YPsvRI3.dllGet hashmaliciousBrowse

                                                                                                                                                                                    Domains

                                                                                                                                                                                    No context

                                                                                                                                                                                    ASN

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                    AS-CHOOPAUScRC6TZG6Wx.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 66.42.57.149
                                                                                                                                                                                    qrb6jVwzoe.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 66.42.57.149
                                                                                                                                                                                    AWB_NO_9284730932.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 45.32.28.45
                                                                                                                                                                                    arm6-20211124-0649Get hashmaliciousBrowse
                                                                                                                                                                                    • 44.168.42.223
                                                                                                                                                                                    6D2FF3CC83EA214E33E4105CCB1051CD85B82E052F615.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    FhP4JYCU7J.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    FhP4JYCU7J.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    bomba.armGet hashmaliciousBrowse
                                                                                                                                                                                    • 44.168.169.161
                                                                                                                                                                                    44E401AAF0B52528AA033257C1A1B8A09A2B10EDF26ED.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    WQRrng5aiw.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    WQRrng5aiw.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    5giHvDqMaLGet hashmaliciousBrowse
                                                                                                                                                                                    • 45.63.53.236
                                                                                                                                                                                    22BA4262D93379DE524029DAFC7528E431E56A22CB293.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    6PZ6S2YGPBGet hashmaliciousBrowse
                                                                                                                                                                                    • 45.63.53.204
                                                                                                                                                                                    kq5Of3SOMZ.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    QABYgAqa5Z.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 149.28.253.196
                                                                                                                                                                                    ZrAv540yA4.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 216.128.137.31
                                                                                                                                                                                    6Xtf11WnP2.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 216.128.137.31
                                                                                                                                                                                    M9WBCy4NNi.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 216.128.137.31
                                                                                                                                                                                    EcobandGHcRC6TZG6Wx.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    qrb6jVwzoe.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    1711.docGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    n6J7QJs4bk.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.109.73
                                                                                                                                                                                    GQwxmGZFvtg.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    wNjqkrm8pH.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    5YO8hZg21O.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    dUGnMYeP1C.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    yFAXc9z51V.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    9fC0as7YLE.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    FIyE6huzxV.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    V0gZWRXv8d.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    t5EuQW2GUF.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    uh1WyesPlh.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    8rryPzJR1p.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    a65FgjVus4.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    bWjYh6H8wk.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    ZJOHKItBoJ.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    eyPPiz3W6u.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190
                                                                                                                                                                                    HjYSwxqyUn.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 196.44.98.190

                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                    51c64c77e60f3980eea90869b68c58a8cRC6TZG6Wx.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    qrb6jVwzoe.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    ReadMe[2021.11.22_12-15].vbsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    cTplVWrqRR.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    NErdgsNsKR.vbsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    F.A.Q[2021.11.22_12-15].vbsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    Q1KL4ickDw.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    yZGYbaJ.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    1711.docGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    cs.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    0MGLPJiSa5.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    0MGLPJiSa5.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    bbyGAgHI9O.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    Vs6ZDk0LMC.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    sTh52oTZDh.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    loveTubeLike.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    2SR3psYDHQ.jsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    GQwxmGZFvtg.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    Fuutbqvhmc.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60
                                                                                                                                                                                    wNjqkrm8pH.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.178.61.60

                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                    No context

                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.chk
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):0.3593198815979092
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                                                                                                                                                                                    MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                                                                                                                                                                                    SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                                                                                                                                                                                    SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                                                                                                                                                                                    SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: .............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.log
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:MPEG-4 LOAS
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                                    Entropy (8bit):0.24941951455300806
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU42:BJiRdwfu2SRU42
                                                                                                                                                                                    MD5:FC6863474F2AB1A11EBFC08BBD3E9F43
                                                                                                                                                                                    SHA1:F4FC946C1C16A5CD15129652980AB2519FB9CC16
                                                                                                                                                                                    SHA-256:1A8B45D05E5FEF9C041CAC5111A09F4B6D00D04B1C5A7C6EB0EFC5EC5A23F68D
                                                                                                                                                                                    SHA-512:1124F306BC86D2B230FD092C615D37001A11311A71190EB3452D26A38AC9427F6D92F933EA78B0B71A4FA3F81792D5E1FB6CB8700CB4BE13D072A6BBCC1BE8A2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0x11dde58d, page size 16384, Windows version 10.0
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):786432
                                                                                                                                                                                    Entropy (8bit):0.25036014689242214
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:LvA+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:LvfSB2nSB2RSjlK/+mLesOj1J2
                                                                                                                                                                                    MD5:F4B2CE76832A1FA56EE42EBD4490028E
                                                                                                                                                                                    SHA1:6213A588EF51ADFD3C110FC39458E2FB722BDD5A
                                                                                                                                                                                    SHA-256:FDC5AB9BE3FE5EC649924CC8266D858A4595787A2EBC7C72163DFB5C232A0BC5
                                                                                                                                                                                    SHA-512:ADFA9002D20664A0EBB5EECCF1EBBC965A2761B2C33FC23B5244547AA2CF576915F9F273C53E070160BD4B4F3895686B49192A424307835B724E0C38DF018C3E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: ...... ................e.f.3...w........................)......7...y...4...y..h.(......7...y....)..............3...w...........................................................................................................B...........@...................................................................................................... ....................................................................................................................................................................................................................................................{5Z.7...y...................A...7...y..........................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                    Entropy (8bit):0.06774787893639142
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:TXZ7vuRmn/rll6/rlxWDl0v1muVulTU5llqll3Vkttlmlnl:lrug/m/rdZOUk3
                                                                                                                                                                                    MD5:955DE7E6C960583E959E43E11EF76240
                                                                                                                                                                                    SHA1:6C70D9E00A8C15BA4EBEC313E3CE9CB929C6939D
                                                                                                                                                                                    SHA-256:27ACE1CA277A38D3A2D2C8653F7E758696D884709D30964DB9E590DFCBC18256
                                                                                                                                                                                    SHA-512:D9F30622DBC34086016202C2E80E0A8128A5C2C81E61E919D56AEFDA58B90E7A252561C4A0DAF1FFB7B26839F26F9695027086958AA42EFB7B008098F8315DFA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: ..%......................................3...w...4...y...7...y...........7...y...7...y..Q.*..7...y...................A...7...y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    File Type:Microsoft Cabinet archive data, 61414 bytes, 1 file
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):61414
                                                                                                                                                                                    Entropy (8bit):7.995245868798237
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:1536:EysgU6qmzixT64jYMZ8HbVPGfVDwm/xLZ9rP:wF6qmeo4eH1m9wmLvrP
                                                                                                                                                                                    MD5:ACAEDA60C79C6BCAC925EEB3653F45E0
                                                                                                                                                                                    SHA1:2AAAE490BCDACCC6172240FF1697753B37AC5578
                                                                                                                                                                                    SHA-256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
                                                                                                                                                                                    SHA-512:FEAA6E7ED7DDA1583739B3E531AB5C562A222EE6ECD042690AE7DCFF966717C6E968469A7797265A11F6E899479AE0F3031E8CF5BEBE1492D5205E9C59690900
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: MSCF............,...................I.......;w........RSNj .authroot.stl..>.(.5..CK..8T....c_.d...A.K...+.d.H..*i.RJJ.IQIR..$t)Kd.-[..T\{..ne......<.w......A..B........c...wi......D....c.0D,L........fy....Rg...=........i,3.3..Z....~^ve<...TF.*...f.zy.,...m.@.0.0...m.3..I(..+..v#...(.2....e...L..*y..V.......~U...."<ke.....l.X:Dt..R<7.5\A7L0=..T.V...IDr..8<....r&...I-.^..b.b.".Af....E.._..r.>.`;,.Hob..S.....7'..\.R$.".g..+..64..@nP.....k3...B.`.G..@D.....L.....`^...#OpW.....!....`.....rf:.}.R.@....gR.#7....l..H.#...d.Qh..3..fCX....==#..M.l..~&....[.J9.\..Ww.....Tx.%....]..a4E...q.+...#.*a..x..O..V.t..Y1!.T..`U...-...< _@...|(.....0..3.`.LU...E0.Gu.4KN....5...?.....I.p..'..........N<.d.O..dH@c1t...[w/...T....cYK.X>.0..Z.....O>..9.3.#9X.%.b...5.YK.E.V.....`./.3.._..nN]..=..M.o.F.._..z....._...gY..!Z..?l....vp.l.:.d.Z..W.....~...N.._.k...&.....$......i.F.d.....D!e.....Y..,.E..m.;.1... $.F..O.F.o_}.uG....,.%.>,.Zx.......o....c../.;....g&.....
                                                                                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:modified
                                                                                                                                                                                    Size (bytes):328
                                                                                                                                                                                    Entropy (8bit):3.1122616792999316
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:kKeEfzk8SN+SkQlPlEGYRMY9z+4KlDA3RUeYlUmlUR/t:Xfz9kPlE99SNxAhUeYlUSA/t
                                                                                                                                                                                    MD5:A4DF8E0551B740A7C7897A3D021C2A8E
                                                                                                                                                                                    SHA1:5B1AD598C1746EA1CF91FFE50910C981F39C2C33
                                                                                                                                                                                    SHA-256:20C01CCAF31CB1DC282EEEB50DEB3AC6D5F43FEF097655A274765F17045740DE
                                                                                                                                                                                    SHA-512:0FF4D37A378BAF9F9146CF150E7D37F05A3472AE5954A9DCE78F57109BC960DDFA5125524512B60BDF3B979559AF1CEAF145C8C47E94D1AED10FCABDC008BB79
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: p...... ........O.S....(....................................................... ........q.\].......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.7.1.e.1.5.c.5.d.c.4.d.7.1.:.0."...
                                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55
                                                                                                                                                                                    Entropy (8bit):4.306461250274409
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                    MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                    SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                    SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                    SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}
                                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
                                                                                                                                                                                    Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                    File Type:Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                                                                                                                    Category:modified
                                                                                                                                                                                    Size (bytes):9062
                                                                                                                                                                                    Entropy (8bit):3.1697062612558384
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:cY+38+DJDD+iDtJC+iw3+gF+O5+6tw+EStN+EjB+m:j+s+5D+Me+X+u+M+j+l+y+m
                                                                                                                                                                                    MD5:DD7478D6F5FE278F580CE5440AC9CA16
                                                                                                                                                                                    SHA1:987DBC4E1FF9E97EDFED9C3A02F76A67C03558C0
                                                                                                                                                                                    SHA-256:035D2306C5FB3AC82EF31986EA9CDDA3FBFD7876AA121D1B5ECA78C83661DEF1
                                                                                                                                                                                    SHA-512:3A13E147D978ECE19103377A0C777B7CB04F52A8C56163C963568BC592F1B02637296843A22CEF0C6496DE2AF47025D651C6B47C059F14838FAD6F508EE65D32
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: ..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.
                                                                                                                                                                                    C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211125_005222_250.etl
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.7875452680796373
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:z5CgC1wo+TK5Ou9o2YKTmCZSI2lIvkWM4mOT2fYFzlUMCbrJRsDK5gyMCcK5nyMA:kQEX332iiyC5kCxCqC7CSCo
                                                                                                                                                                                    MD5:BE4E74DFFFF3B35181EA6C5AA01FFB3A
                                                                                                                                                                                    SHA1:D16BBCCA2F4E9202120BE7BFD7457936976DD81D
                                                                                                                                                                                    SHA-256:CB8F08C21DCCF806470F214B2ADFA42A6D12AC2FBE1918989A63D4E65A328B48
                                                                                                                                                                                    SHA-512:02D2088E566573E5E5E958B83EF71D18586B7D369FA0632D895040718BBB4FE20BF7248993E249D9E830456E18D8D3CD13C3B088CBB27DAFB572B2D72FA2371D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: .... ... ....................................... ...!...........................`.......A........................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................N...=..... .....................8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.1.2.5._.0.0.5.2.2.2._.2.5.0...e.t.l.........P.P.`.......A.......................................................................................................................................................................................................................................................................

                                                                                                                                                                                    Static File Info

                                                                                                                                                                                    General

                                                                                                                                                                                    File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Entropy (8bit):5.428775577219427
                                                                                                                                                                                    TrID:
                                                                                                                                                                                    • Win32 Dynamic Link Library (generic) (1002004/3) 99.40%
                                                                                                                                                                                    • Win16/32 Executable Delphi generic (2074/23) 0.21%
                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.20%
                                                                                                                                                                                    File name:pPX9DaPVYj.dll
                                                                                                                                                                                    File size:425984
                                                                                                                                                                                    MD5:8b540033f4ffd79e5109e41a06f3e876
                                                                                                                                                                                    SHA1:86a8b94f1a3102ad3741fabccfe5ea5d9a3bf624
                                                                                                                                                                                    SHA256:2b3700c2a383b322dadfebfea00d9bc85b05a37793dc366954dd8c882f3006e2
                                                                                                                                                                                    SHA512:60f3a7b684c9f000bb08fb0f01b74ffa38aeb2d77a6dec3a0daacf93dc4bf9f95edcdf1124c6dd6083e479335017d12f82b445d3bda7e2ff7cf4c20505d08fae
                                                                                                                                                                                    SSDEEP:6144:1ACzUEcRRKxe0DUAldEzpLGE0sepO8+wM:1lxemHQtGE0sLvd
                                                                                                                                                                                    File Content Preview:MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L....A.a...........!.....T...P.......................................................H....@..........................S..P..

                                                                                                                                                                                    File Icon

                                                                                                                                                                                    Icon Hash:64da98ecd2ceead4

                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                    General

                                                                                                                                                                                    Entrypoint:0x1001cab0
                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                    Imagebase:0x10000000
                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                                                                                    Time Stamp:0x619E410C [Wed Nov 24 13:41:32 2021 UTC]
                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                    OS Version Major:6
                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                    File Version Major:6
                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                    Subsystem Version Major:6
                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                    Import Hash:ef559179cbfc08fc57c1e24c241992ea

                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                    Instruction
                                                                                                                                                                                    push ebp
                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                    cmp dword ptr [ebp+0Ch], 01h
                                                                                                                                                                                    jne 00007FC08C92A397h
                                                                                                                                                                                    call 00007FC08C92A3F7h
                                                                                                                                                                                    push dword ptr [ebp+10h]
                                                                                                                                                                                    push dword ptr [ebp+0Ch]
                                                                                                                                                                                    push dword ptr [ebp+08h]
                                                                                                                                                                                    call 00007FC08C92A248h
                                                                                                                                                                                    add esp, 0Ch
                                                                                                                                                                                    pop ebp
                                                                                                                                                                                    retn 000Ch
                                                                                                                                                                                    push ebp
                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                    sub esp, 14h
                                                                                                                                                                                    and dword ptr [ebp-0Ch], 00000000h
                                                                                                                                                                                    lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                    and dword ptr [ebp-08h], 00000000h
                                                                                                                                                                                    push eax
                                                                                                                                                                                    call dword ptr [1002806Ch]
                                                                                                                                                                                    mov eax, dword ptr [ebp-08h]
                                                                                                                                                                                    xor eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                    mov dword ptr [ebp-04h], eax
                                                                                                                                                                                    call dword ptr [10028068h]
                                                                                                                                                                                    xor dword ptr [ebp-04h], eax
                                                                                                                                                                                    call dword ptr [10028050h]
                                                                                                                                                                                    xor dword ptr [ebp-04h], eax
                                                                                                                                                                                    lea eax, dword ptr [ebp-14h]
                                                                                                                                                                                    push eax
                                                                                                                                                                                    call dword ptr [10028064h]
                                                                                                                                                                                    mov eax, dword ptr [ebp-10h]
                                                                                                                                                                                    lea ecx, dword ptr [ebp-04h]
                                                                                                                                                                                    xor eax, dword ptr [ebp-14h]
                                                                                                                                                                                    xor eax, dword ptr [ebp-04h]
                                                                                                                                                                                    xor eax, ecx
                                                                                                                                                                                    leave
                                                                                                                                                                                    ret
                                                                                                                                                                                    mov ecx, dword ptr [1004609Ch]
                                                                                                                                                                                    push esi
                                                                                                                                                                                    push edi
                                                                                                                                                                                    mov edi, BB40E64Eh
                                                                                                                                                                                    mov esi, FFFF0000h
                                                                                                                                                                                    cmp ecx, edi
                                                                                                                                                                                    je 00007FC08C92A396h
                                                                                                                                                                                    test esi, ecx
                                                                                                                                                                                    jne 00007FC08C92A3B8h
                                                                                                                                                                                    call 00007FC08C92A329h
                                                                                                                                                                                    mov ecx, eax
                                                                                                                                                                                    cmp ecx, edi
                                                                                                                                                                                    jne 00007FC08C92A399h
                                                                                                                                                                                    mov ecx, BB40E64Fh
                                                                                                                                                                                    jmp 00007FC08C92A3A0h
                                                                                                                                                                                    test esi, ecx
                                                                                                                                                                                    jne 00007FC08C92A39Ch
                                                                                                                                                                                    or eax, 00004711h
                                                                                                                                                                                    shl eax, 10h
                                                                                                                                                                                    or ecx, eax
                                                                                                                                                                                    mov dword ptr [1004609Ch], ecx
                                                                                                                                                                                    not ecx
                                                                                                                                                                                    pop edi
                                                                                                                                                                                    mov dword ptr [10046098h], ecx
                                                                                                                                                                                    pop esi
                                                                                                                                                                                    ret
                                                                                                                                                                                    push 1005E118h
                                                                                                                                                                                    call dword ptr [10028070h]
                                                                                                                                                                                    ret

                                                                                                                                                                                    Data Directories

                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x453000x50.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x453500x28.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x610000xb7b8.rsrc
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x6d0000x10f0.reloc
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x44be00x38.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x44c180x40.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x280000x124.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                    Sections

                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                    .flat0x10000x4460x600False0.643229166667data5.67523607022IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .text0x20000x252cb0x25400False0.536086933725data5.88986915783IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .rdata0x280000x1d9da0x1da00False0.494923523207data5.10028459369IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .data0x460000x1aab00x17e00False0.51547161322data4.96852691532IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .rsrc0x610000xb7b80xb800False0.177564538043data3.89759299523IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .reloc0x6d0000x10f00x1200False0.782335069444data6.41113333729IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                    Resources

                                                                                                                                                                                    NameRVASizeTypeLanguageCountry
                                                                                                                                                                                    RT_ICON0x614b00xb13PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedRussianRussia
                                                                                                                                                                                    RT_ICON0x61fc80xea8dataRussianRussia
                                                                                                                                                                                    RT_ICON0x62e700x8a8dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0RussianRussia
                                                                                                                                                                                    RT_ICON0x637180x568GLS_BINARY_LSB_FIRSTRussianRussia
                                                                                                                                                                                    RT_ICON0x63c800xc4aPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedRussianRussia
                                                                                                                                                                                    RT_ICON0x648d00x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 61695, next used block 4294934272RussianRussia
                                                                                                                                                                                    RT_ICON0x68af80x25a8dataRussianRussia
                                                                                                                                                                                    RT_ICON0x6b0a00x10a8dataRussianRussia
                                                                                                                                                                                    RT_ICON0x6c1480x468GLS_BINARY_LSB_FIRSTRussianRussia
                                                                                                                                                                                    RT_GROUP_ICON0x6c5b00x84dataRussianRussia
                                                                                                                                                                                    RT_VERSION0x612b00x200dataRussianRussia
                                                                                                                                                                                    RT_MANIFEST0x6c6380x17dXML 1.0 document textEnglishUnited States

                                                                                                                                                                                    Imports

                                                                                                                                                                                    DLLImport
                                                                                                                                                                                    KERNEL32.dllInterlockedFlushSList, GetProcessHeap, HeapAlloc, HeapFree, GetLastError, GetCommandLineA, ExitProcess, GetModuleHandleA, GetProcAddress, CloseHandle, TerminateProcess, WaitForSingleObject, VirtualProtect, SetLastError, VirtualFree, VirtualAlloc, LoadLibraryA, GetNativeSystemInfo, FreeLibrary, IsBadReadPtr, GetCurrentProcessId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, WriteConsoleW, DecodePointer, RtlUnwind, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, RaiseException, GetModuleHandleExW, GetModuleFileNameW, LCMapStringW, GetStdHandle, GetFileType, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, FlushFileBuffers, WriteFile, GetConsoleCP, GetConsoleMode, SetStdHandle, SetFilePointerEx, GetStringTypeW, HeapSize, CreateFileW

                                                                                                                                                                                    Exports

                                                                                                                                                                                    NameOrdinalAddress
                                                                                                                                                                                    Control_RunDLL10x1000209d

                                                                                                                                                                                    Version Infos

                                                                                                                                                                                    DescriptionData
                                                                                                                                                                                    LegalCopyrightCopyright (C) 2021
                                                                                                                                                                                    ProductVersion1.0.0.1
                                                                                                                                                                                    FileDescriptionApplication
                                                                                                                                                                                    FileVersion1.0.0.1
                                                                                                                                                                                    CompanyNameA company
                                                                                                                                                                                    Translation0x0419 0x04b0

                                                                                                                                                                                    Possible Origin

                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                    RussianRussia
                                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                    Snort IDS Alerts

                                                                                                                                                                                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                                                                                                    11/24/21-16:52:19.289668TCP2404334ET CNC Feodo Tracker Reported CnC Server TCP group 1849751443192.168.2.751.178.61.60
                                                                                                                                                                                    11/24/21-16:52:20.089765TCP2404312ET CNC Feodo Tracker Reported CnC Server TCP group 74975280192.168.2.7168.197.250.14
                                                                                                                                                                                    11/24/21-16:52:21.998581TCP2404332ET CNC Feodo Tracker Reported CnC Server TCP group 17497538080192.168.2.745.79.33.48
                                                                                                                                                                                    11/24/21-16:52:43.306423TCP2404322ET CNC Feodo Tracker Reported CnC Server TCP group 12497578080192.168.2.7196.44.98.190
                                                                                                                                                                                    11/24/21-16:53:04.351060TCP2404314ET CNC Feodo Tracker Reported CnC Server TCP group 8497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    11/24/21-16:53:04.881124TCP2021013ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)708049772177.72.80.14192.168.2.7

                                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                                    TCP Packets

                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                    Nov 24, 2021 16:52:19.289668083 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.289737940 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.289834023 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.311877966 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.311928034 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.432533979 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.432696104 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.834808111 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.834856033 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.835609913 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.838196993 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.881314993 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.924882889 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.981415033 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.981492043 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:19.981674910 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:19.981694937 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:20.008826017 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:20.008876085 CET4434975151.178.61.60192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:20.008891106 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:20.009975910 CET49751443192.168.2.751.178.61.60
                                                                                                                                                                                    Nov 24, 2021 16:52:20.089765072 CET4975280192.168.2.7168.197.250.14
                                                                                                                                                                                    Nov 24, 2021 16:52:20.361020088 CET8049752168.197.250.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:20.872375965 CET4975280192.168.2.7168.197.250.14
                                                                                                                                                                                    Nov 24, 2021 16:52:21.143549919 CET8049752168.197.250.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:21.653675079 CET4975280192.168.2.7168.197.250.14
                                                                                                                                                                                    Nov 24, 2021 16:52:21.926702976 CET8049752168.197.250.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:52:21.998580933 CET497538080192.168.2.745.79.33.48
                                                                                                                                                                                    Nov 24, 2021 16:52:25.060262918 CET497538080192.168.2.745.79.33.48
                                                                                                                                                                                    Nov 24, 2021 16:52:31.076478958 CET497538080192.168.2.745.79.33.48
                                                                                                                                                                                    Nov 24, 2021 16:52:43.306422949 CET497578080192.168.2.7196.44.98.190
                                                                                                                                                                                    Nov 24, 2021 16:52:46.312052965 CET497578080192.168.2.7196.44.98.190
                                                                                                                                                                                    Nov 24, 2021 16:52:52.328149080 CET497578080192.168.2.7196.44.98.190
                                                                                                                                                                                    Nov 24, 2021 16:53:04.351059914 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:04.599721909 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:04.599893093 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:04.600399971 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:04.848778009 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:04.881124020 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:04.881141901 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:04.881652117 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:04.881664038 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:08.795705080 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:09.056107998 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:09.059551001 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:09.074740887 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:09.366739988 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:10.205133915 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:10.205251932 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:13.207972050 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:13.208271980 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:53:13.210916042 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:53:13.213958025 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:54:09.630690098 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:54:09.630728006 CET497727080192.168.2.7177.72.80.14
                                                                                                                                                                                    Nov 24, 2021 16:54:09.879400015 CET708049772177.72.80.14192.168.2.7
                                                                                                                                                                                    Nov 24, 2021 16:54:09.882939100 CET497727080192.168.2.7177.72.80.14

                                                                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                                                                    • 51.178.61.60

                                                                                                                                                                                    HTTPS Proxied Packets

                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                    0192.168.2.74975151.178.61.60443C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                    2021-11-24 15:52:19 UTC0OUTGET /euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK HTTP/1.1
                                                                                                                                                                                    Cookie: VkztqiHrcfJdN=ApwlpkLXHikt80ZX+rUy7QNus1UrOzvArQ2wT9a3pzG/LUBUBtVLGWZUvhWo++76HscbZaar1ecNJ2NE9drzI+WYO0CrHXBK96gsrw5gCDv1H6FDJl4E1ekAk6rTT5+tRKnKwaubeNjES2yzAZ1ahqbQap+ahvLDVY0Qeg8dZyFp/mT2xfuy2YrZ9Y4gh8SdNUmOMTIzF7OqgRdAc+m0GdjTDMrrOF8BD44A4Z4RsQ0CT4V3SWcXRNU/sbnThRJ79M/3w70CfUdRJu8qNans8M5bB4RoXwYtmb2k0+VOyCLBxVpj
                                                                                                                                                                                    Host: 51.178.61.60
                                                                                                                                                                                    Connection: Keep-Alive
                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                    2021-11-24 15:52:19 UTC0INHTTP/1.1 404 Not Found
                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                    Date: Wed, 24 Nov 2021 15:52:19 GMT
                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                    Content-Length: 162
                                                                                                                                                                                    Connection: close
                                                                                                                                                                                    2021-11-24 15:52:19 UTC0INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                    Code Manipulations

                                                                                                                                                                                    Statistics

                                                                                                                                                                                    Behavior

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    System Behavior

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:07
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\loaddll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:loaddll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll"
                                                                                                                                                                                    Imagebase:0x8c0000
                                                                                                                                                                                    File size:893440 bytes
                                                                                                                                                                                    MD5 hash:72FCD8FB0ADC38ED9050569AD673650E
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:07
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
                                                                                                                                                                                    Imagebase:0x870000
                                                                                                                                                                                    File size:232960 bytes
                                                                                                                                                                                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:08
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                                                                                                                                                                                    Imagebase:0x100000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:08
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
                                                                                                                                                                                    Imagebase:0x100000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:08
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
                                                                                                                                                                                    Imagebase:0x100000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:09
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL
                                                                                                                                                                                    Imagebase:0x100000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000003.258124529.00000000028B6000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:10
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:10
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp
                                                                                                                                                                                    Imagebase:0x100000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.264342755.0000000002EB6000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:12
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL
                                                                                                                                                                                    Imagebase:0x100000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000003.513585241.0000000003173000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000003.328562700.0000000003173000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000003.278848660.0000000003173000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:17
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:20
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:21
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:22
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:23
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                                                                                                    Imagebase:0x7ff6de5a0000
                                                                                                                                                                                    File size:163336 bytes
                                                                                                                                                                                    MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:25
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:35
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:52:50
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:53:08
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff641cd0000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:53:25
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                                                                                    Imagebase:0x7ff630340000
                                                                                                                                                                                    File size:455656 bytes
                                                                                                                                                                                    MD5 hash:A267555174BFA53844371226F482B86B
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Start time:16:53:26
                                                                                                                                                                                    Start date:24/11/2021
                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    Imagebase:0x7ff774ee0000
                                                                                                                                                                                    File size:625664 bytes
                                                                                                                                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    Disassembly

                                                                                                                                                                                    Code Analysis

                                                                                                                                                                                    Reset < >