Windows Analysis Report 2gyA5uNl6VPQUA.dll

AV Detection:

Found malware configuration

Source: 5.2.rundll32.exe.7e0000.0.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Source: 2gyA5uNl6VPQUA.dll

Virustotal: Detection: 17%

Perma Link

Compliance:

Uses 32bit PE files

Source: 2gyA5uNl6VPQUA.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 46.55.222.11:443 -> 192.168.2.3:49806 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 2gyA5uNl6VPQUA.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9E2FE7 FindFirstFileExW,		1_2_6E9E2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E2FE7 FindFirstFileExW,		3_2_6E9E2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012018AC FindFirstFileW,		25_2_012018AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01201750 FindFirstFileW,		25_2_01201750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120183F FindFirstFileW,		25_2_0120183F

Networking:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 46.55.222.11 187

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /UKKmNexCiEZNdWysJnUxJeBGVUutat HTTP/1.1Cookie: ryViNxlKLE=9E+7EQIWXaUCIB8lnocBFFwUUiBI8SGBfem5avtBjtVXnImPnR3whzMx0REyqL1Uc4BT3kSyDvkg+xE+CEuKtlih6TF+LkZeje1NbjVTi54TDmgo60tk/Kg/NR9aYRHyTOl+2ET6B9p/LkYlQ5eWXFQF+pel2YIcjQhyqb10bAUn21aDx78snz7WrQWN4T5bpw+7YlmPsZM9sv8/HvOYXAWEyssXnp5p0QBoT6AdMnxwJrqCeVO7AnBv3qafuoZpQrj4x4SA+CHiBieL+jDSad8SNnwqvg==Host: 46.55.222.11Connection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 18

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11

URLs found in memory or binary data

Source: rundll32.exe, 00000019.00000002.816080192.000000000117E000.00000004.00000001.sdmp, rundll32.exe, 00000019.00000003.794999609.000000000117E000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000002.714011218.0000023EE6500000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000001B.00000002.713879734.0000023EE5CEF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001B.00000003.688588185.0000023EE657F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.688701923.0000023EE65D0000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: Amcache.hve.19.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 00000019.00000002.816002840.000000000115E000.00000004.00000001.sdmp	String found in binary or memory: https://46.55.222.11/
Source: rundll32.exe, 00000019.00000002.815929088.0000000001137000.00000004.00000020.sdmp	String found in binary or memory: https://46.55.222.11/UKKmNexCiEZNdWysJnUxJeBGVUutat
Source: rundll32.exe, 00000019.00000002.815886128.000000000110A000.00000004.00000020.sdmp	String found in binary or memory: https://46.55.222.11/UKKmNexCiEZNdWysJnUxJeBGVUutatZ
Source: svchost.exe, 0000001B.00000003.688588185.0000023EE657F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.688701923.0000023EE65D0000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000001B.00000003.688588185.0000023EE657F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.688701923.0000023EE65D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001B.00000003.688588185.0000023EE657F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.688701923.0000023EE65D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001B.00000003.694452575.0000023EE658F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.694431854.0000023EE65A6000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.694469243.0000023EE6A02000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.694398444.0000023EE65A6000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Contains functionality to download additional files from the internet

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 25_2_01216E69 InternetReadFile,

25_2_01216E69

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /UKKmNexCiEZNdWysJnUxJeBGVUutat HTTP/1.1Cookie: ryViNxlKLE=9E+7EQIWXaUCIB8lnocBFFwUUiBI8SGBfem5avtBjtVXnImPnR3whzMx0REyqL1Uc4BT3kSyDvkg+xE+CEuKtlih6TF+LkZeje1NbjVTi54TDmgo60tk/Kg/NR9aYRHyTOl+2ET6B9p/LkYlQ5eWXFQF+pel2YIcjQhyqb10bAUn21aDx78snz7WrQWN4T5bpw+7YlmPsZM9sv8/HvOYXAWEyssXnp5p0QBoT6AdMnxwJrqCeVO7AnBv3qafuoZpQrj4x4SA+CHiBieL+jDSad8SNnwqvg==Host: 46.55.222.11Connection: Keep-AliveCache-Control: no-cache

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 46.55.222.11:443 -> 192.168.2.3:49806 version: TLS 1.2

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 1.0.loaddll32.exe.930000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.812098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.ec0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.eb2170.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.f90000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.eb2170.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.852098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.1200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.1200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.852098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.570000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.930000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.f42468.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.a63b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.f42468.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.12d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.a63b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.12d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.812098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.778115242.000000000112B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.578776757.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.578455384.00000000007FA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.596108665.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.595999827.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.549793958.0000000000F90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.663770243.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.578639964.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.586858412.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.578325190.0000000000570000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.816294229.0000000001200000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.513859712.0000000003649000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.586723752.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.584768753.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.663823655.0000000000F2A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.585019489.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.567434432.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.564974375.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538768779.0000000000E9A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.550893742.00000000012D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.557633995.00000000007E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.557657494.000000000083A000.00000004.00000020.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: 2gyA5uNl6VPQUA.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6376 -ip 6376

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Qrcyfrqyrevqn\zfjlg.mpd:Zone.Identifier

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Qrcyfrqyrevqn\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094ED95		1_2_0094ED95
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093C69B		1_2_0093C69B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093F699		1_2_0093F699
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093D899		1_2_0093D899
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00933085		1_2_00933085
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00943ABE		1_2_00943ABE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093AEB9		1_2_0093AEB9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094B0BA		1_2_0094B0BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009404A4		1_2_009404A4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093F4A5		1_2_0093F4A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009456A9		1_2_009456A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009368AD		1_2_009368AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00950AD3		1_2_00950AD3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00947EDD		1_2_00947EDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009354C0		1_2_009354C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093BEF5		1_2_0093BEF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009520F8		1_2_009520F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093E6FD		1_2_0093E6FD
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009506EF		1_2_009506EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093A8E8		1_2_0093A8E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00952C16		1_2_00952C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00941C12		1_2_00941C12
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094BA18		1_2_0094BA18
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093F20D		1_2_0093F20D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00940A37		1_2_00940A37
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00933E3B		1_2_00933E3B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094CC3F		1_2_0094CC3F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00940824		1_2_00940824
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094645F		1_2_0094645F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094604E		1_2_0094604E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00951C71		1_2_00951C71
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094E478		1_2_0094E478
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00950C66		1_2_00950C66
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00946B91		1_2_00946B91
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00951987		1_2_00951987
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00937D87		1_2_00937D87
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093F984		1_2_0093F984
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093938F		1_2_0093938F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009477A7		1_2_009477A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094BFA1		1_2_0094BFA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009333A9		1_2_009333A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094E7DA		1_2_0094E7DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009489DA		1_2_009489DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009413DB		1_2_009413DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00935DC3		1_2_00935DC3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009339C3		1_2_009339C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00944DC5		1_2_00944DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00940FC5		1_2_00940FC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00932DC5		1_2_00932DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009491F7		1_2_009491F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00931DF9		1_2_00931DF9
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094D5FE		1_2_0094D5FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00936BFE		1_2_00936BFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_009535E3		1_2_009535E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093FBEF		1_2_0093FBEF
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093B7EC		1_2_0093B7EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00938112		1_2_00938112
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00934716		1_2_00934716
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00935314		1_2_00935314
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00948518		1_2_00948518
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00953306		1_2_00953306
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094710D		1_2_0094710D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094D10B		1_2_0094D10B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00943130		1_2_00943130
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093E336		1_2_0093E336
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00937739		1_2_00937739
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094473A		1_2_0094473A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00936125		1_2_00936125
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094CF2C		1_2_0094CF2C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093B12E		1_2_0093B12E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00938D59		1_2_00938D59
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093635F		1_2_0093635F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00934F42		1_2_00934F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094C145		1_2_0094C145
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00952D4F		1_2_00952D4F
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0095314A		1_2_0095314A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00932176		1_2_00932176
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094C772		1_2_0094C772
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00932575		1_2_00932575
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00945B7C		1_2_00945B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093597D		1_2_0093597D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00932B7C		1_2_00932B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0094F561		1_2_0094F561
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00935166		1_2_00935166
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093DD66		1_2_0093DD66
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00952560		1_2_00952560
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00939565		1_2_00939565
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093196D		1_2_0093196D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093996C		1_2_0093996C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9C5EA0		1_2_6E9C5EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9CA6D0		1_2_6E9CA6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9CE6E0		1_2_6E9CE6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9C66E0		1_2_6E9C66E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9D0F10		1_2_6E9D0F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9C1C10		1_2_6E9C1C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9C75F4		1_2_6E9C75F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9C9D50		1_2_6E9C9D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9E0A61		1_2_6E9E0A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9CD380		1_2_6E9CD380
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9C38C0		1_2_6E9C38C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9D01D0		1_2_6E9D01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E3130		3_2_012E3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D5314		3_2_012D5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D8112		3_2_012D8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D196D		3_2_012D196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D2B7C		3_2_012D2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D8D59		3_2_012D8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EED95		3_2_012EED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E91F7		3_2_012E91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EE7DA		3_2_012EE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E89DA		3_2_012E89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EBA18		3_2_012EBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E604E		3_2_012E604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E56A9		3_2_012E56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DAEB9		3_2_012DAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F06EF		3_2_012F06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012ECF2C		3_2_012ECF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DB12E		3_2_012DB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D6125		3_2_012D6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D7739		3_2_012D7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E473A		3_2_012E473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DE336		3_2_012DE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E710D		3_2_012E710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012ED10B		3_2_012ED10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F3306		3_2_012F3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E8518		3_2_012E8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D4716		3_2_012D4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D996C		3_2_012D996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D9565		3_2_012D9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D5166		3_2_012D5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DDD66		3_2_012DDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EF561		3_2_012EF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F2560		3_2_012F2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D597D		3_2_012D597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E5B7C		3_2_012E5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D2575		3_2_012D2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D2176		3_2_012D2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EC772		3_2_012EC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F2D4F		3_2_012F2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F314A		3_2_012F314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EC145		3_2_012EC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D4F42		3_2_012D4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D635F		3_2_012D635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D33A9		3_2_012D33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E77A7		3_2_012E77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EBFA1		3_2_012EBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D938F		3_2_012D938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F1987		3_2_012F1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DF984		3_2_012DF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D7D87		3_2_012D7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E6B91		3_2_012E6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DB7EC		3_2_012DB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DFBEF		3_2_012DFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F35E3		3_2_012F35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012ED5FE		3_2_012ED5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D6BFE		3_2_012D6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D1DF9		3_2_012D1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D2DC5		3_2_012D2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E4DC5		3_2_012E4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E0FC5		3_2_012E0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D5DC3		3_2_012D5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D39C3		3_2_012D39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E13DB		3_2_012E13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E0824		3_2_012E0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012ECC3F		3_2_012ECC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D3E3B		3_2_012D3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E0A37		3_2_012E0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DF20D		3_2_012DF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F2C16		3_2_012F2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E1C12		3_2_012E1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F0C66		3_2_012F0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EE478		3_2_012EE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F1C71		3_2_012F1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E645F		3_2_012E645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D68AD		3_2_012D68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DF4A5		3_2_012DF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E04A4		3_2_012E04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E3ABE		3_2_012E3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012EB0BA		3_2_012EB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D3085		3_2_012D3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DF699		3_2_012DF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DD899		3_2_012DD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DC69B		3_2_012DC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DA8E8		3_2_012DA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DE6FD		3_2_012DE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F20F8		3_2_012F20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012DBEF5		3_2_012DBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D54C0		3_2_012D54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E7EDD		3_2_012E7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012F0AD3		3_2_012F0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9C5EA0		3_2_6E9C5EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9CA6D0		3_2_6E9CA6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9CE6E0		3_2_6E9CE6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9C66E0		3_2_6E9C66E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D0F10		3_2_6E9D0F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9C1C10		3_2_6E9C1C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9C75F4		3_2_6E9C75F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9C9D50		3_2_6E9C9D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E0A61		3_2_6E9E0A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9CD380		3_2_6E9CD380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9C38C0		3_2_6E9C38C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D01D0		3_2_6E9D01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01208112		25_2_01208112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121F561		25_2_0121F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120DD66		25_2_0120DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120996C		25_2_0120996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120196D		25_2_0120196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01202176		25_2_01202176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01202B7C		25_2_01202B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01215B7C		25_2_01215B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120635F		25_2_0120635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012033A9		25_2_012033A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120F984		25_2_0120F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121ED95		25_2_0121ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120B7EC		25_2_0120B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120FBEF		25_2_0120FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012191F7		25_2_012191F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01214DC5		25_2_01214DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012113DB		25_2_012113DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121E7DA		25_2_0121E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01220C66		25_2_01220C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012156A9		25_2_012156A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120F699		25_2_0120F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120C69B		25_2_0120C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012220F8		25_2_012220F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01206125		25_2_01206125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121CF2C		25_2_0121CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120B12E		25_2_0120B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01213130		25_2_01213130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120E336		25_2_0120E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01207739		25_2_01207739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121473A		25_2_0121473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01223306		25_2_01223306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121D10B		25_2_0121D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121710D		25_2_0121710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01205314		25_2_01205314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01204716		25_2_01204716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01218518		25_2_01218518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01222560		25_2_01222560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01209565		25_2_01209565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01205166		25_2_01205166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121C772		25_2_0121C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01202575		25_2_01202575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120597D		25_2_0120597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01204F42		25_2_01204F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121C145		25_2_0121C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0122314A		25_2_0122314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01222D4F		25_2_01222D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01201750		25_2_01201750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01208D59		25_2_01208D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121BFA1		25_2_0121BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012177A7		25_2_012177A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01221987		25_2_01221987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01207D87		25_2_01207D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120938F		25_2_0120938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01216B91		25_2_01216B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012235E3		25_2_012235E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01201DF9		25_2_01201DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01206BFE		25_2_01206BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121D5FE		25_2_0121D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01205DC3		25_2_01205DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012039C3		25_2_012039C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01210FC5		25_2_01210FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01202DC5		25_2_01202DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012189DA		25_2_012189DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01210824		25_2_01210824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01210A37		25_2_01210A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01203E3B		25_2_01203E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121CC3F		25_2_0121CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120F20D		25_2_0120F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01211C12		25_2_01211C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01222C16		25_2_01222C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121BA18		25_2_0121BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01221C71		25_2_01221C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121E478		25_2_0121E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121604E		25_2_0121604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121645F		25_2_0121645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012104A4		25_2_012104A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120F4A5		25_2_0120F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012068AD		25_2_012068AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120AEB9		25_2_0120AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0121B0BA		25_2_0121B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01213ABE		25_2_01213ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01203085		25_2_01203085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120D899		25_2_0120D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120A8E8		25_2_0120A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012206EF		25_2_012206EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120BEF5		25_2_0120BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120E6FD		25_2_0120E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012054C0		25_2_012054C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01220AD3		25_2_01220AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01217EDD		25_2_01217EDD

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E9C1C10 appears 97 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E9DD350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E9C1C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E9DD350 appears 33 times

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: 2gyA5uNl6VPQUA.dll

Virustotal: Detection: 17%

PE file has an executable .text section and no other executable section

Source: 2gyA5uNl6VPQUA.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,bhramccfbdd
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qrcyfrqyrevqn\zfjlg.mpd",GeWefLGOgdb
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6376 -ip 6376
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 304
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 164 -p 6376 -ip 6376
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 308
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Qrcyfrqyrevqn\zfjlg.mpd",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,axamexdrqyrgb			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,bhramccfbdd			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qrcyfrqyrevqn\zfjlg.mpd",GeWefLGOgdb			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Qrcyfrqyrevqn\zfjlg.mpd",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6376 -ip 6376			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 164 -p 6376 -ip 6376			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 308			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Creates files inside the user directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Creates temporary files

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6A5.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal88.troj.evad.winDLL@37/14@0/29

Reads ini files

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 25_2_0120EF64 CreateToolhelp32Snapshot,

25_2_0120EF64

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll,Control_RunDLL

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6376
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6284:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7092:64:WilError_01

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 2gyA5uNl6VPQUA.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 2gyA5uNl6VPQUA.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.590625804.0000000005281000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093151C push ds; ret		1_2_00931527
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_0093150F push ds; ret		1_2_00931527
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9E9153 push ecx; ret		1_2_6E9E9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D150F push ds; ret		3_2_012D1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012D151C push ds; ret		3_2_012D1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E9153 push ecx; ret		3_2_6E9E9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120150F push ds; ret		25_2_01201527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120151C push ds; ret		25_2_01201527

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E9CE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

1_2_6E9CE4E0

Persistence and Installation Behavior:

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Qrcyfrqyrevqn\zfjlg.mpd

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Qrcyfrqyrevqn\zfjlg.mpd:Zone.Identifier read attributes | delete

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 6160

Thread sleep time: -150000s >= -30000s

Jump to behavior

Queries a list of all running processes

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9E2FE7 FindFirstFileExW,		1_2_6E9E2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E2FE7 FindFirstFileExW,		3_2_6E9E2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_012018AC FindFirstFileW,		25_2_012018AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01201750 FindFirstFileW,		25_2_01201750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_0120183F FindFirstFileW,		25_2_0120183F

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.19.dr	Binary or memory string: VMware
Source: Amcache.hve.19.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.19.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.19.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.19.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: rundll32.exe, 00000019.00000003.795038474.000000000115E000.00000004.00000001.sdmp, rundll32.exe, 00000019.00000002.815929088.0000000001137000.00000004.00000020.sdmp, rundll32.exe, 00000019.00000002.816002840.000000000115E000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000002.713723013.0000023EE5C70000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000002.713872119.0000023EE5CE5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.19.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.19.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.19.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.19.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E9DD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6E9DD1CC

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E9CE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

1_2_6E9CE4E0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E9C1290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

1_2_6E9C1290

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_00944315 mov eax, dword ptr fs:[00000030h]		1_2_00944315
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9DC050 mov eax, dword ptr fs:[00000030h]		1_2_6E9DC050
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9DBFE0 mov esi, dword ptr fs:[00000030h]		1_2_6E9DBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9DBFE0 mov eax, dword ptr fs:[00000030h]		1_2_6E9DBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9E12CB mov ecx, dword ptr fs:[00000030h]		1_2_6E9E12CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9E298C mov eax, dword ptr fs:[00000030h]		1_2_6E9E298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_012E4315 mov eax, dword ptr fs:[00000030h]		3_2_012E4315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DC050 mov eax, dword ptr fs:[00000030h]		3_2_6E9DC050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DBFE0 mov esi, dword ptr fs:[00000030h]		3_2_6E9DBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DBFE0 mov eax, dword ptr fs:[00000030h]		3_2_6E9DBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E12CB mov ecx, dword ptr fs:[00000030h]		3_2_6E9E12CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E298C mov eax, dword ptr fs:[00000030h]		3_2_6E9E298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 25_2_01214315 mov eax, dword ptr fs:[00000030h]		25_2_01214315

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_0093E259 LdrInitializeThunk,

1_2_0093E259

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9DCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6E9DCB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9DD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6E9DD1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E9E29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6E9E29E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6E9DCB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6E9DD1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6E9E29E6

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 46.55.222.11 187

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\2gyA5uNl6VPQUA.dll",#1			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6376 -ip 6376			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 164 -p 6376 -ip 6376			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 308			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: svchost.exe, 00000000.00000002.816329484.000001D51B790000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.575281363.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.585221007.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.586969396.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.578890630.00000000010A0000.00000002.00020000.sdmp, rundll32.exe, 00000019.00000002.817345899.0000000003560000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000000.00000002.816329484.000001D51B790000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.575281363.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.585221007.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.586969396.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.578890630.00000000010A0000.00000002.00020000.sdmp, rundll32.exe, 00000019.00000002.817345899.0000000003560000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000000.00000002.816329484.000001D51B790000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.575281363.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.585221007.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.586969396.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.578890630.00000000010A0000.00000002.00020000.sdmp, rundll32.exe, 00000019.00000002.817345899.0000000003560000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: svchost.exe, 00000000.00000002.816329484.000001D51B790000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.575281363.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.585221007.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.586969396.00000000010A0000.00000002.00020000.sdmp, loaddll32.exe, 00000001.00000000.578890630.00000000010A0000.00000002.00020000.sdmp, rundll32.exe, 00000019.00000002.817345899.0000000003560000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\rundll32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E9DCC44 cpuid

1_2_6E9DCC44

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6E9DCE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6E9DCE15

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.19.dr, Amcache.hve.LOG1.19.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.19.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.19.dr, Amcache.hve.LOG1.19.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 1.0.loaddll32.exe.930000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.812098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.ec0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.eb2170.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.f90000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.eb2170.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.852098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.1200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.rundll32.exe.1200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.930000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.852098.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.570000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.930000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.7e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.f42468.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.a63b70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.loaddll32.exe.a63b70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.f42468.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.12d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.a63b70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.12d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.812098.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.778115242.000000000112B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.578776757.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.578455384.00000000007FA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.596108665.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.595999827.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.549793958.0000000000F90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.663770243.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.578639964.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.586858412.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.578325190.0000000000570000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.816294229.0000000001200000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.513859712.0000000003649000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.586723752.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.584768753.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.663823655.0000000000F2A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.585019489.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.567434432.0000000000A5D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.564974375.0000000000930000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.538768779.0000000000E9A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.550893742.00000000012D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.557633995.00000000007E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.557657494.000000000083A000.00000004.00000020.sdmp, type: MEMORY