Windows Analysis Report 6zAcNlJXo7.dll

AV Detection:

Found malware configuration

Source: 4.2.rundll32.exe.2d44168.1.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Source: 6zAcNlJXo7.dll	Virustotal: Detection: 23%			Perma Link
Source: 6zAcNlJXo7.dll	ReversingLabs: Detection: 24%

Compliance:

Uses 32bit PE files

Source: 6zAcNlJXo7.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 6zAcNlJXo7.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.602824148.00000000049DE000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.602932789.000000000328A000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.619910392.00000000031BC000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.620547498.00000000031BC000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.611725686.0000000000912000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000014.00000003.619910392.00000000031BC000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.620547498.00000000031BC000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EAA2FE7 FindFirstFileExW,		0_2_6EAA2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EAA2FE7 FindFirstFileExW,		2_2_6EAA2FE7

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 19

URLs found in memory or binary data

Source: svchost.exe, 00000008.00000003.547746216.00000162642A0000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.557044428.00000162642A0000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.700137823.00000162642A1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.640644218.0000000004F84000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.640563575.0000000004F70000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000002.642313149.0000000004F85000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000008.00000003.547746216.00000162642A0000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.557044428.00000162642A0000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.700137823.00000162642A1000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: Amcache.hve.17.dr	String found in binary or memory: http://upx.sf.net

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 0.0.loaddll32.exe.a60000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.622160.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.2ce22d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.2ce22d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.b93b30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.742148.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.622160.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.742148.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.8e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.970000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2d44168.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2d44168.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.b93b30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.598946349.000000000072A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596768757.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.615675303.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.557368858.0000000002D65000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.595689976.000000000060A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.597386823.00000000008E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.642951852.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.643045864.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597549993.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.613993965.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.615392489.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.598782764.00000000003C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597443170.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.599282857.0000000002D2A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.699398284.0000000002CCA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596835233.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.614123815.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.576404694.0000000000970000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.595650059.0000000000510000.00000040.00000010.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: 6zAcNlJXo7.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4668 -ip 4668

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Zsdkqzebleakbz\gnpornwqabjsi.vaq:Zone.Identifier

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Zsdkqzebleakbz\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7ED95		0_2_00A7ED95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A704A4		0_2_00A704A4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6F4A5		0_2_00A6F4A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A668AD		0_2_00A668AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A756A9		0_2_00A756A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A73ABE		0_2_00A73ABE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7B0BA		0_2_00A7B0BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6AEB9		0_2_00A6AEB9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A63085		0_2_00A63085
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6C69B		0_2_00A6C69B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6F699		0_2_00A6F699
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6D899		0_2_00A6D899
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A806EF		0_2_00A806EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6A8E8		0_2_00A6A8E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A820F8		0_2_00A820F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6BEF5		0_2_00A6BEF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6E6FD		0_2_00A6E6FD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A654C0		0_2_00A654C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A77EDD		0_2_00A77EDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A80AD3		0_2_00A80AD3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A70824		0_2_00A70824
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A70A37		0_2_00A70A37
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7CC3F		0_2_00A7CC3F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A63E3B		0_2_00A63E3B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6F20D		0_2_00A6F20D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A71C12		0_2_00A71C12
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A82C16		0_2_00A82C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7BA18		0_2_00A7BA18
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A80C66		0_2_00A80C66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A81C71		0_2_00A81C71
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7E478		0_2_00A7E478
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7604E		0_2_00A7604E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7645F		0_2_00A7645F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A777A7		0_2_00A777A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7BFA1		0_2_00A7BFA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A633A9		0_2_00A633A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A67D87		0_2_00A67D87
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6F984		0_2_00A6F984
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6938F		0_2_00A6938F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A81987		0_2_00A81987
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A76B91		0_2_00A76B91
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6FBEF		0_2_00A6FBEF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6B7EC		0_2_00A6B7EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A835E3		0_2_00A835E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A791F7		0_2_00A791F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A66BFE		0_2_00A66BFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7D5FE		0_2_00A7D5FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A61DF9		0_2_00A61DF9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A74DC5		0_2_00A74DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A70FC5		0_2_00A70FC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A62DC5		0_2_00A62DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A65DC3		0_2_00A65DC3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A639C3		0_2_00A639C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A713DB		0_2_00A713DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7E7DA		0_2_00A7E7DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A789DA		0_2_00A789DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A66125		0_2_00A66125
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6B12E		0_2_00A6B12E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7CF2C		0_2_00A7CF2C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6E336		0_2_00A6E336
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A73130		0_2_00A73130
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7473A		0_2_00A7473A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A67739		0_2_00A67739
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7710D		0_2_00A7710D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7D10B		0_2_00A7D10B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A83306		0_2_00A83306
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A64716		0_2_00A64716
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A65314		0_2_00A65314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A68112		0_2_00A68112
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A78518		0_2_00A78518
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A65166		0_2_00A65166
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6DD66		0_2_00A6DD66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A69565		0_2_00A69565
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7F561		0_2_00A7F561
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A82560		0_2_00A82560
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6996C		0_2_00A6996C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6196D		0_2_00A6196D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A62176		0_2_00A62176
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A62575		0_2_00A62575
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7C772		0_2_00A7C772
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A62B7C		0_2_00A62B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A75B7C		0_2_00A75B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6597D		0_2_00A6597D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A8314A		0_2_00A8314A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A7C145		0_2_00A7C145
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A64F42		0_2_00A64F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A82D4F		0_2_00A82D4F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6635F		0_2_00A6635F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A68D59		0_2_00A68D59
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA85EA0		0_2_6EA85EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA8E6E0		0_2_6EA8E6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA866E0		0_2_6EA866E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA8A6D0		0_2_6EA8A6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA90F10		0_2_6EA90F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA81C10		0_2_6EA81C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA875F4		0_2_6EA875F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA89D50		0_2_6EA89D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EAA0A61		0_2_6EAA0A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA8D380		0_2_6EA8D380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA838C0		0_2_6EA838C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA901D0		0_2_6EA901D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097F699		2_2_0097F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097AEB9		2_2_0097AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009856A9		2_2_009856A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009906EF		2_2_009906EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098BA18		2_2_0098BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098604E		2_2_0098604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098ED95		2_2_0098ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098E7DA		2_2_0098E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009889DA		2_2_009889DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009891F7		2_2_009891F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00975314		2_2_00975314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00978112		2_2_00978112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00983130		2_2_00983130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00978D59		2_2_00978D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00972B7C		2_2_00972B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097196D		2_2_0097196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097C69B		2_2_0097C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097D899		2_2_0097D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00973085		2_2_00973085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098B0BA		2_2_0098B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00983ABE		2_2_00983ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097F4A5		2_2_0097F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009768AD		2_2_009768AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009804A4		2_2_009804A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00987EDD		2_2_00987EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00990AD3		2_2_00990AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009754C0		2_2_009754C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009920F8		2_2_009920F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097BEF5		2_2_0097BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097E6FD		2_2_0097E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097A8E8		2_2_0097A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00981C12		2_2_00981C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00992C16		2_2_00992C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097F20D		2_2_0097F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098CC3F		2_2_0098CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00973E3B		2_2_00973E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00980A37		2_2_00980A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00980824		2_2_00980824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098645F		2_2_0098645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098E478		2_2_0098E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00991C71		2_2_00991C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00990C66		2_2_00990C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00986B91		2_2_00986B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00977D87		2_2_00977D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097F984		2_2_0097F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097938F		2_2_0097938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00991987		2_2_00991987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098BFA1		2_2_0098BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009733A9		2_2_009733A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009877A7		2_2_009877A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009813DB		2_2_009813DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00972DC5		2_2_00972DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00975DC3		2_2_00975DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009739C3		2_2_009739C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00984DC5		2_2_00984DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00980FC5		2_2_00980FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098D5FE		2_2_0098D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00976BFE		2_2_00976BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00971DF9		2_2_00971DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097FBEF		2_2_0097FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009935E3		2_2_009935E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097B7EC		2_2_0097B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00988518		2_2_00988518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00974716		2_2_00974716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098D10B		2_2_0098D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098710D		2_2_0098710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00993306		2_2_00993306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097E336		2_2_0097E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098473A		2_2_0098473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00977739		2_2_00977739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00976125		2_2_00976125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098CF2C		2_2_0098CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097B12E		2_2_0097B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097635F		2_2_0097635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0099314A		2_2_0099314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00974F42		2_2_00974F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00992D4F		2_2_00992D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098C145		2_2_0098C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00972176		2_2_00972176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00972575		2_2_00972575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00985B7C		2_2_00985B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098C772		2_2_0098C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097597D		2_2_0097597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00975166		2_2_00975166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097DD66		2_2_0097DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00979565		2_2_00979565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0098F561		2_2_0098F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00992560		2_2_00992560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097996C		2_2_0097996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA85EA0		2_2_6EA85EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA8E6E0		2_2_6EA8E6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA866E0		2_2_6EA866E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA8A6D0		2_2_6EA8A6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA90F10		2_2_6EA90F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA81C10		2_2_6EA81C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA875F4		2_2_6EA875F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA89D50		2_2_6EA89D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EAA0A61		2_2_6EAA0A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA8D380		2_2_6EA8D380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA838C0		2_2_6EA838C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA901D0		2_2_6EA901D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005306EF		3_2_005306EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052ED95		3_2_0052ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052645F		3_2_0052645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052604E		3_2_0052604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00531C71		3_2_00531C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052E478		3_2_0052E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00530C66		3_2_00530C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00521C12		3_2_00521C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00532C16		3_2_00532C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052BA18		3_2_0052BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051F20D		3_2_0051F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00520A37		3_2_00520A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00513E3B		3_2_00513E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052CC3F		3_2_0052CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00520824		3_2_00520824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00530AD3		3_2_00530AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00527EDD		3_2_00527EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005154C0		3_2_005154C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051BEF5		3_2_0051BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005320F8		3_2_005320F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051E6FD		3_2_0051E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051A8E8		3_2_0051A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051F699		3_2_0051F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051D899		3_2_0051D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051C69B		3_2_0051C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00513085		3_2_00513085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052B0BA		3_2_0052B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051AEB9		3_2_0051AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00523ABE		3_2_00523ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051F4A5		3_2_0051F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005204A4		3_2_005204A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005256A9		3_2_005256A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005168AD		3_2_005168AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00518D59		3_2_00518D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051635F		3_2_0051635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00514F42		3_2_00514F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052C145		3_2_0052C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0053314A		3_2_0053314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00532D4F		3_2_00532D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052C772		3_2_0052C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00512575		3_2_00512575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00512176		3_2_00512176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051597D		3_2_0051597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00512B7C		3_2_00512B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00525B7C		3_2_00525B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052F561		3_2_0052F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00532560		3_2_00532560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00519565		3_2_00519565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00515166		3_2_00515166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051DD66		3_2_0051DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051196D		3_2_0051196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051996C		3_2_0051996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00518112		3_2_00518112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00515314		3_2_00515314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00514716		3_2_00514716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00528518		3_2_00528518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00533306		3_2_00533306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052D10B		3_2_0052D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052710D		3_2_0052710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00523130		3_2_00523130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051E336		3_2_0051E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00517739		3_2_00517739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052473A		3_2_0052473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00516125		3_2_00516125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052CF2C		3_2_0052CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051B12E		3_2_0051B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052E7DA		3_2_0052E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005289DA		3_2_005289DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005213DB		3_2_005213DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00515DC3		3_2_00515DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005139C3		3_2_005139C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00512DC5		3_2_00512DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00524DC5		3_2_00524DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00520FC5		3_2_00520FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005291F7		3_2_005291F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00511DF9		3_2_00511DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052D5FE		3_2_0052D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00516BFE		3_2_00516BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005335E3		3_2_005335E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051B7EC		3_2_0051B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051FBEF		3_2_0051FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00531987		3_2_00531987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051F984		3_2_0051F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00517D87		3_2_00517D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051938F		3_2_0051938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0052BFA1		3_2_0052BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005277A7		3_2_005277A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_005133A9		3_2_005133A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E06EF		5_2_003E06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DED95		5_2_003DED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DCC3F		5_2_003DCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C3E3B		5_2_003C3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D0A37		5_2_003D0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D0824		5_2_003D0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DBA18		5_2_003DBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E2C16		5_2_003E2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D1C12		5_2_003D1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CF20D		5_2_003CF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DE478		5_2_003DE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E1C71		5_2_003E1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E0C66		5_2_003E0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D645F		5_2_003D645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D604E		5_2_003D604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D3ABE		5_2_003D3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CAEB9		5_2_003CAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DB0BA		5_2_003DB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C68AD		5_2_003C68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D56A9		5_2_003D56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D04A4		5_2_003D04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CF4A5		5_2_003CF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CF699		5_2_003CF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CD899		5_2_003CD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CC69B		5_2_003CC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C3085		5_2_003C3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CE6FD		5_2_003CE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E20F8		5_2_003E20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CBEF5		5_2_003CBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CA8E8		5_2_003CA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D7EDD		5_2_003D7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E0AD3		5_2_003E0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C54C0		5_2_003C54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C7739		5_2_003C7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D473A		5_2_003D473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CE336		5_2_003CE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D3130		5_2_003D3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DCF2C		5_2_003DCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CB12E		5_2_003CB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C6125		5_2_003C6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D8518		5_2_003D8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C5314		5_2_003C5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C4716		5_2_003C4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C8112		5_2_003C8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D710D		5_2_003D710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DD10B		5_2_003DD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E3306		5_2_003E3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C2B7C		5_2_003C2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D5B7C		5_2_003D5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C597D		5_2_003C597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C2575		5_2_003C2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C2176		5_2_003C2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DC772		5_2_003DC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C996C		5_2_003C996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C196D		5_2_003C196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C9565		5_2_003C9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C5166		5_2_003C5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CDD66		5_2_003CDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DF561		5_2_003DF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E2560		5_2_003E2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C635F		5_2_003C635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C8D59		5_2_003C8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E2D4F		5_2_003E2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E314A		5_2_003E314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DC145		5_2_003DC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C4F42		5_2_003C4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C33A9		5_2_003C33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D77A7		5_2_003D77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DBFA1		5_2_003DBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C938F		5_2_003C938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CF984		5_2_003CF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E1987		5_2_003E1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C7D87		5_2_003C7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C6BFE		5_2_003C6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DD5FE		5_2_003DD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C1DF9		5_2_003C1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D91F7		5_2_003D91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CB7EC		5_2_003CB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003CFBEF		5_2_003CFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003E35E3		5_2_003E35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D13DB		5_2_003D13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003DE7DA		5_2_003DE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D89DA		5_2_003D89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D4DC5		5_2_003D4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D0FC5		5_2_003D0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C2DC5		5_2_003C2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C5DC3		5_2_003C5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C39C3		5_2_003C39C3

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EA9D350 appears 33 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EA81C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EA9D350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EA81C10 appears 97 times

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: 6zAcNlJXo7.dll	Virustotal: Detection: 23%
Source: 6zAcNlJXo7.dll	ReversingLabs: Detection: 24%

PE file has an executable .text section and no other executable section

Source: 6zAcNlJXo7.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6zAcNlJXo7.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6zAcNlJXo7.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6zAcNlJXo7.dll,bhramccfbdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Zsdkqzebleakbz\gnpornwqabjsi.vaq",YawfQDI
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",Control_RunDLL
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4668 -ip 4668
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 272
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4668 -ip 4668
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 324
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6zAcNlJXo7.dll,Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6zAcNlJXo7.dll,axamexdrqyrgb			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6zAcNlJXo7.dll,bhramccfbdd			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Zsdkqzebleakbz\gnpornwqabjsi.vaq",YawfQDI			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4668 -ip 4668			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 272			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4668 -ip 4668			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 324			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Creates temporary files

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C87.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal72.troj.evad.winDLL@32/18@0/30

Reads ini files

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6zAcNlJXo7.dll,Control_RunDLL

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:2824:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3160:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4668

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 6zAcNlJXo7.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 6zAcNlJXo7.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.602824148.00000000049DE000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.602932789.000000000328A000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.619910392.00000000031BC000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.620547498.00000000031BC000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.605463455.0000000004DB1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.625076490.0000000005351000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.611725686.0000000000912000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000014.00000003.619910392.00000000031BC000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.620547498.00000000031BC000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6005E push esp; iretd		0_2_00A60061
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6150F push ds; ret		0_2_00A61527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A6151C push ds; ret		0_2_00A61527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EAA9153 push ecx; ret		0_2_6EAA9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097005E push esp; iretd		2_2_00970061
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097151C push ds; ret		2_2_00971527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0097150F push ds; ret		2_2_00971527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EAA9153 push ecx; ret		2_2_6EAA9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051005E push esp; iretd		3_2_00510061
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051151C push ds; ret		3_2_00511527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0051150F push ds; ret		3_2_00511527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C005E push esp; iretd		5_2_003C0061
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C151C push ds; ret		5_2_003C1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003C150F push ds; ret		5_2_003C1527

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EA8E4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EA8E4E0

Persistence and Installation Behavior:

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Zsdkqzebleakbz\gnpornwqabjsi.vaq

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Zsdkqzebleakbz\gnpornwqabjsi.vaq:Zone.Identifier read attributes | delete

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 7116

Thread sleep time: -30000s >= -30000s

Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Queries a list of all running processes

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EAA2FE7 FindFirstFileExW,		0_2_6EAA2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EAA2FE7 FindFirstFileExW,		2_2_6EAA2FE7

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.17.dr	Binary or memory string: VMware
Source: Amcache.hve.17.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: svchost.exe, 00000008.00000002.699954981.0000016264261000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: Amcache.hve.17.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.17.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.17.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000008.00000002.699887933.000001626424D000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.640632475.0000000004F56000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000002.642248757.0000000004F57000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.640563575.0000000004F70000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000002.642284557.0000000004F72000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.17.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.17.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.17.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: svchost.exe, 00000008.00000002.698194989.000001625EC29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWM&db
Source: Amcache.hve.17.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: WerFault.exe, 00000014.00000003.639127810.0000000004F42000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.17.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EAA29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6EAA29E6

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EA8E4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EA8E4E0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EA81290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

0_2_6EA81290

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00A74315 mov eax, dword ptr fs:[00000030h]		0_2_00A74315
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA9C050 mov eax, dword ptr fs:[00000030h]		0_2_6EA9C050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA9BFE0 mov esi, dword ptr fs:[00000030h]		0_2_6EA9BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA9BFE0 mov eax, dword ptr fs:[00000030h]		0_2_6EA9BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EAA12CB mov ecx, dword ptr fs:[00000030h]		0_2_6EAA12CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EAA298C mov eax, dword ptr fs:[00000030h]		0_2_6EAA298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00984315 mov eax, dword ptr fs:[00000030h]		2_2_00984315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA9C050 mov eax, dword ptr fs:[00000030h]		2_2_6EA9C050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA9BFE0 mov esi, dword ptr fs:[00000030h]		2_2_6EA9BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA9BFE0 mov eax, dword ptr fs:[00000030h]		2_2_6EA9BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EAA12CB mov ecx, dword ptr fs:[00000030h]		2_2_6EAA12CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EAA298C mov eax, dword ptr fs:[00000030h]		2_2_6EAA298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00524315 mov eax, dword ptr fs:[00000030h]		3_2_00524315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003D4315 mov eax, dword ptr fs:[00000030h]		5_2_003D4315

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00A6E259 LdrInitializeThunk,

0_2_00A6E259

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA9CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6EA9CB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EAA29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6EAA29E6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EA9D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6EA9D1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA9CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_6EA9CB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EAA29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_6EAA29E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EA9D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_6EA9D1CC

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6zAcNlJXo7.dll",#1			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4668 -ip 4668			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 272			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4668 -ip 4668			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 324			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000000.614311053.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.615784660.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.597627953.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596883586.0000000001240000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.614311053.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.615784660.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.597627953.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596883586.0000000001240000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.614311053.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.615784660.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.597627953.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596883586.0000000001240000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.614311053.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.615784660.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.597627953.0000000001240000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596883586.0000000001240000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EA9CC44 cpuid

0_2_6EA9CC44

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EA9CE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6EA9CE15

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.17.dr, Amcache.hve.LOG1.17.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.17.dr, Amcache.hve.LOG1.17.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 0.0.loaddll32.exe.a60000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.622160.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.2ce22d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.2ce22d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.b93b30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.742148.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.622160.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.742148.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.8e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.970000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2d44168.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2d44168.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.b93b30.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.b93b30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.598946349.000000000072A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596768757.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.615675303.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.557368858.0000000002D65000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.595689976.000000000060A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.597386823.00000000008E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.642951852.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.643045864.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597549993.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.613993965.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.615392489.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.598782764.00000000003C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597443170.0000000000A60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.599282857.0000000002D2A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.699398284.0000000002CCA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596835233.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.614123815.0000000000B8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.576404694.0000000000970000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.595650059.0000000000510000.00000040.00000010.sdmp, type: MEMORY