Windows Analysis Report mal.dll

AV Detection:

Found malware configuration

Source: 0.0.loaddll32.exe.cf0000.0.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Multi AV Scanner detection for submitted file

Source: mal.dll

ReversingLabs: Detection: 24%

Compliance:

Uses 32bit PE files

Source: mal.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: mal.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049802183.00000000047F5000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 0000000F.00000003.1068429245.00000000005AC000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: a`ojrcoCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000D.00000002.1060706786.0000000000732000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E572FE7 FindFirstFileExW,		0_2_6E572FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E572FE7 FindFirstFileExW,		2_2_6E572FE7

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 18

URLs found in memory or binary data

Source: WerFault.exe, 0000000F.00000002.1099269166.0000000000DEB000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1097471671.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1097559454.0000000000DEA000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000000.00000000.1063245558.0000000000E7B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1037130438.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1168490551.0000000002D7A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063275616.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035699542.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033480524.000000000310A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.971608734.0000000002CD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063104639.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1031543020.0000000002E63000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035947080.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035732972.0000000003193000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033332210.0000000003070000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1167572272.0000000000A90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100911301.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1064906650.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1037359091.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100727595.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1065208047.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: mal.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Lxelxho\ggoife.qjv:Zone.Identifier

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Lxelxho\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E55A6D0		0_2_6E55A6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E55E6E0		0_2_6E55E6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5566E0		0_2_6E5566E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E555EA0		0_2_6E555EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E560F10		0_2_6E560F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E551C10		0_2_6E551C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E559D50		0_2_6E559D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5575F4		0_2_6E5575F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E570A61		0_2_6E570A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E55D380		0_2_6E55D380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5538C0		0_2_6E5538C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5601D0		0_2_6E5601D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008156A9		2_2_008156A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080AEB9		2_2_0080AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008206EF		2_2_008206EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081BA18		2_2_0081BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081604E		2_2_0081604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081ED95		2_2_0081ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081E7DA		2_2_0081E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008189DA		2_2_008189DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008191F7		2_2_008191F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00808112		2_2_00808112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00805314		2_2_00805314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00813130		2_2_00813130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00808D59		2_2_00808D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080196D		2_2_0080196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802B7C		2_2_00802B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00803085		2_2_00803085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F699		2_2_0080F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080D899		2_2_0080D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080C69B		2_2_0080C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008104A4		2_2_008104A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F4A5		2_2_0080F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008068AD		2_2_008068AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081B0BA		2_2_0081B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00813ABE		2_2_00813ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008054C0		2_2_008054C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00820AD3		2_2_00820AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00817EDD		2_2_00817EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080A8E8		2_2_0080A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080BEF5		2_2_0080BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008220F8		2_2_008220F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080E6FD		2_2_0080E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F20D		2_2_0080F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00811C12		2_2_00811C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00822C16		2_2_00822C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00810824		2_2_00810824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00810A37		2_2_00810A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00803E3B		2_2_00803E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081CC3F		2_2_0081CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081645F		2_2_0081645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00820C66		2_2_00820C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00821C71		2_2_00821C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081E478		2_2_0081E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F984		2_2_0080F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00821987		2_2_00821987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00807D87		2_2_00807D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080938F		2_2_0080938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00816B91		2_2_00816B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081BFA1		2_2_0081BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008177A7		2_2_008177A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008033A9		2_2_008033A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00805DC3		2_2_00805DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008039C3		2_2_008039C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00814DC5		2_2_00814DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00810FC5		2_2_00810FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802DC5		2_2_00802DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008113DB		2_2_008113DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008235E3		2_2_008235E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080B7EC		2_2_0080B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080FBEF		2_2_0080FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00801DF9		2_2_00801DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00806BFE		2_2_00806BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081D5FE		2_2_0081D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00823306		2_2_00823306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081D10B		2_2_0081D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081710D		2_2_0081710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00804716		2_2_00804716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00818518		2_2_00818518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00806125		2_2_00806125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081CF2C		2_2_0081CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080B12E		2_2_0080B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080E336		2_2_0080E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00807739		2_2_00807739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081473A		2_2_0081473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00804F42		2_2_00804F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081C145		2_2_0081C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0082314A		2_2_0082314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00822D4F		2_2_00822D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080635F		2_2_0080635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081F561		2_2_0081F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00822560		2_2_00822560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00809565		2_2_00809565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00805166		2_2_00805166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080DD66		2_2_0080DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080996C		2_2_0080996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081C772		2_2_0081C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802575		2_2_00802575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802176		2_2_00802176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00815B7C		2_2_00815B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080597D		2_2_0080597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E55A6D0		2_2_6E55A6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E55E6E0		2_2_6E55E6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5566E0		2_2_6E5566E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E555EA0		2_2_6E555EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E560F10		2_2_6E560F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E551C10		2_2_6E551C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E559D50		2_2_6E559D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5575F4		2_2_6E5575F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E570A61		2_2_6E570A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E55D380		2_2_6E55D380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5538C0		2_2_6E5538C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5601D0		2_2_6E5601D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE06EF		3_2_02CE06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDED95		3_2_02CDED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC54C0		3_2_02CC54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD7EDD		3_2_02CD7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE0AD3		3_2_02CE0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCA8E8		3_2_02CCA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCE6FD		3_2_02CCE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE20F8		3_2_02CE20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCBEF5		3_2_02CCBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC3085		3_2_02CC3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF699		3_2_02CCF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCD899		3_2_02CCD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCC69B		3_2_02CCC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD56A9		3_2_02CD56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD04A4		3_2_02CD04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF4A5		3_2_02CCF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD3ABE		3_2_02CD3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCAEB9		3_2_02CCAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDB0BA		3_2_02CDB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD604E		3_2_02CD604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD645F		3_2_02CD645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE0C66		3_2_02CE0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDE478		3_2_02CDE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE1C71		3_2_02CE1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF20D		3_2_02CCF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDBA18		3_2_02CDBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE2C16		3_2_02CE2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD1C12		3_2_02CD1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD0824		3_2_02CD0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDCC3F		3_2_02CDCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC3E3B		3_2_02CC3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD0A37		3_2_02CD0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD4DC5		3_2_02CD4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD0FC5		3_2_02CD0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2DC5		3_2_02CC2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC5DC3		3_2_02CC5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC39C3		3_2_02CC39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD13DB		3_2_02CD13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDE7DA		3_2_02CDE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD89DA		3_2_02CD89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCB7EC		3_2_02CCB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCFBEF		3_2_02CCFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE35E3		3_2_02CE35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC6BFE		3_2_02CC6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDD5FE		3_2_02CDD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC1DF9		3_2_02CC1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD91F7		3_2_02CD91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC938F		3_2_02CC938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF984		3_2_02CCF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE1987		3_2_02CE1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC7D87		3_2_02CC7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD6B91		3_2_02CD6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC33A9		3_2_02CC33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD77A7		3_2_02CD77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDBFA1		3_2_02CDBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE2D4F		3_2_02CE2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE314A		3_2_02CE314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDC145		3_2_02CDC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC4F42		3_2_02CC4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC635F		3_2_02CC635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC8D59		3_2_02CC8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC996C		3_2_02CC996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC196D		3_2_02CC196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC9565		3_2_02CC9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC5166		3_2_02CC5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCDD66		3_2_02CCDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDF561		3_2_02CDF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE2560		3_2_02CE2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2B7C		3_2_02CC2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD5B7C		3_2_02CD5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC597D		3_2_02CC597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2575		3_2_02CC2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2176		3_2_02CC2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDC772		3_2_02CDC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD710D		3_2_02CD710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDD10B		3_2_02CDD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE3306		3_2_02CE3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD8518		3_2_02CD8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC5314		3_2_02CC5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC4716		3_2_02CC4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC8112		3_2_02CC8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDCF2C		3_2_02CDCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCB12E		3_2_02CCB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC6125		3_2_02CC6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC7739		3_2_02CC7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD473A		3_2_02CD473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCE336		3_2_02CCE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD3130		3_2_02CD3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B106EF		5_2_04B106EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0ED95		5_2_04B0ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0B0BA		5_2_04B0B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF4A5		5_2_04AFF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B03ABE		5_2_04B03ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B004A4		5_2_04B004A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFAEB9		5_2_04AFAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B056A9		5_2_04B056A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF3085		5_2_04AF3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFC69B		5_2_04AFC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF699		5_2_04AFF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFD899		5_2_04AFD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFA8E8		5_2_04AFA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B120F8		5_2_04B120F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFE6FD		5_2_04AFE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFBEF5		5_2_04AFBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B10AD3		5_2_04B10AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B07EDD		5_2_04B07EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF54C0		5_2_04AF54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B00A37		5_2_04B00A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0CC3F		5_2_04B0CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B00824		5_2_04B00824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF3E3B		5_2_04AF3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF20D		5_2_04AFF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B01C12		5_2_04B01C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B12C16		5_2_04B12C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0BA18		5_2_04B0BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B11C71		5_2_04B11C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0E478		5_2_04B0E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B10C66		5_2_04B10C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0645F		5_2_04B0645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0604E		5_2_04B0604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF33A9		5_2_04AF33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0BFA1		5_2_04B0BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B077A7		5_2_04B077A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF938F		5_2_04AF938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B06B91		5_2_04B06B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF7D87		5_2_04AF7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF984		5_2_04AFF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B11987		5_2_04B11987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFFBEF		5_2_04AFFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFB7EC		5_2_04AFB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B091F7		5_2_04B091F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0D5FE		5_2_04B0D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF6BFE		5_2_04AF6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B135E3		5_2_04B135E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF1DF9		5_2_04AF1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0E7DA		5_2_04B0E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2DC5		5_2_04AF2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B089DA		5_2_04B089DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B013DB		5_2_04B013DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF5DC3		5_2_04AF5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF39C3		5_2_04AF39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B04DC5		5_2_04B04DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B00FC5		5_2_04B00FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B03130		5_2_04B03130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFB12E		5_2_04AFB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0473A		5_2_04B0473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF6125		5_2_04AF6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF7739		5_2_04AF7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFE336		5_2_04AFE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0CF2C		5_2_04B0CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B08518		5_2_04B08518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B13306		5_2_04B13306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF4716		5_2_04AF4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0D10B		5_2_04B0D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF5314		5_2_04AF5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF8112		5_2_04AF8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0710D		5_2_04B0710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0C772		5_2_04B0C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF196D		5_2_04AF196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF996C		5_2_04AF996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF5166		5_2_04AF5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFDD66		5_2_04AFDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF9565		5_2_04AF9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B05B7C		5_2_04B05B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0F561		5_2_04B0F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B12560		5_2_04B12560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF597D		5_2_04AF597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2B7C		5_2_04AF2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2176		5_2_04AF2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2575		5_2_04AF2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF4F42		5_2_04AF4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF635F		5_2_04AF635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0C145		5_2_04B0C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF8D59		5_2_04AF8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B1314A		5_2_04B1314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B12D4F		5_2_04B12D4F

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E551C10 appears 97 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E56D350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E551C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E56D350 appears 33 times

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: mal.dll

ReversingLabs: Detection: 24%

PE file has an executable .text section and no other executable section

Source: mal.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\mal.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lxelxho\ggoife.qjv",clLaoeKXf
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lxelxho\ggoife.qjv",clLaoeKXf			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Creates temporary files

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2338.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal80.troj.evad.winDLL@34/14@0/29

Reads ini files

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6880
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4588:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5648:64:WilError_01

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: mal.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: mal.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049802183.00000000047F5000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 0000000F.00000003.1068429245.00000000005AC000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: a`ojrcoCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000D.00000002.1060706786.0000000000732000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E579153 push ecx; ret		0_2_6E579166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080150F push ds; ret		2_2_00801527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080151C push ds; ret		2_2_00801527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E579153 push ecx; ret		2_2_6E579166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC150F push ds; ret		3_2_02CC1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC151C push ds; ret		3_2_02CC1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF150F push ds; ret		5_2_04AF1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF151C push ds; ret		5_2_04AF1527

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E55E4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E55E4E0

Persistence and Installation Behavior:

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Lxelxho\ggoife.qjv

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Lxelxho\ggoife.qjv:Zone.Identifier read attributes | delete

Jump to behavior

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found large amount of non-executed APIs

Source: C:\Windows\System32\loaddll32.exe	API coverage: 6.4 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 9.8 %

Queries a list of all running processes

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E572FE7 FindFirstFileExW,		0_2_6E572FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E572FE7 FindFirstFileExW,		2_2_6E572FE7

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 0000000F.00000003.1097517730.0000000000DAF000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1097471671.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.1099244090.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.1099138817.0000000000DAF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.me
Source: WerFault.exe, 0000000F.00000003.1097471671.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.1099244090.0000000000DDA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW_
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: WerFault.exe, 0000000F.00000003.1095876016.0000000000DAF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6E56D1CC

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E55E4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E55E4E0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E551290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

0_2_6E551290

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56C050 mov eax, dword ptr fs:[00000030h]		0_2_6E56C050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56BFE0 mov esi, dword ptr fs:[00000030h]		0_2_6E56BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56BFE0 mov eax, dword ptr fs:[00000030h]		0_2_6E56BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5712CB mov ecx, dword ptr fs:[00000030h]		0_2_6E5712CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E57298C mov eax, dword ptr fs:[00000030h]		0_2_6E57298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00814315 mov eax, dword ptr fs:[00000030h]		2_2_00814315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56C050 mov eax, dword ptr fs:[00000030h]		2_2_6E56C050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56BFE0 mov esi, dword ptr fs:[00000030h]		2_2_6E56BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56BFE0 mov eax, dword ptr fs:[00000030h]		2_2_6E56BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5712CB mov ecx, dword ptr fs:[00000030h]		2_2_6E5712CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E57298C mov eax, dword ptr fs:[00000030h]		2_2_6E57298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD4315 mov eax, dword ptr fs:[00000030h]		3_2_02CD4315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B04315 mov eax, dword ptr fs:[00000030h]		5_2_04B04315

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6E56CB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E56D1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5729E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E5729E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_6E56CB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_6E56D1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5729E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_6E5729E6

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E56CC44 cpuid

0_2_6E56CC44

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E56CE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6E56CE15

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.13.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1037130438.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1168490551.0000000002D7A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063275616.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035699542.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033480524.000000000310A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.971608734.0000000002CD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063104639.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1031543020.0000000002E63000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035947080.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035732972.0000000003193000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033332210.0000000003070000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1167572272.0000000000A90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100911301.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1064906650.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1037359091.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100727595.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1065208047.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY