Windows Analysis Report TYLNb8VvnmYA.dll

Overview

General Information

Sample Name:	TYLNb8VvnmYA.dll
Analysis ID:	532264
MD5:	2b155f0eb4240dbe18024ca82e2418ca
SHA1:	a84ba84de27be3294350f7428de56355b4417a79
SHA256:	60b8988a2c2fc3f2108ab8cb49d8a7a566f5bcd2036dca941c5863f9085c3a9d
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Sigma detected: Emotet RunDLL32 Process Creation

Multi AV Scanner detection for domain / URL

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Abnormal high CPU Usage

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Connects to several IPs in different countries

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Signatures

AV Detection:

Found malware configuration

Source: 4.2.rundll32.exe.da0000.0.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Multi AV Scanner detection for submitted file

Source: TYLNb8VvnmYA.dll

Virustotal: Detection: 25%

Perma Link

Multi AV Scanner detection for domain / URL

Source: https://46.55.222.11/

Virustotal: Detection: 7%

Perma Link

Compliance:

Uses 32bit PE files

Source: TYLNb8VvnmYA.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: unknown

HTTPS traffic detected: 46.55.222.11:443 -> 192.168.2.4:49810 version: TLS 1.2

Source: TYLNb8VvnmYA.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.947501464.0000000004AB7000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: a[ojr^oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000E.00000002.957692909.0000000002C92000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.949867302.0000000004E41000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.971559419.0000000005151000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E572FE7 FindFirstFileExW,		0_2_6E572FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E572FE7 FindFirstFileExW,		3_2_6E572FE7

Networking:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 46.55.222.11 187

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11
Source: unknown	TCP traffic detected without corresponding DNS query: 46.55.222.11

Source: svchost.exe, 0000001B.00000003.1147321502.000001EEEB38F000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001B.00000003.1147321502.000001EEEB38F000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001B.00000003.1147321502.000001EEEB38F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1147295297.000001EEEB3A0000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-26T13:57:30.0386475Z\|\|.\|\|6f0c105d-3db6-47de-894d-fd95973349e2\|\|1152921505694224549\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001B.00000003.1147321502.000001EEEB38F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1147295297.000001EEEB3A0000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-26T13:57:30.0386475Z\|\|.\|\|6f0c105d-3db6-47de-894d-fd95973349e2\|\|1152921505694224549\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"

Source: WerFault.exe, 00000011.00000003.986145656.0000000004E1A000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000002.987701658.0000000004E1C000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.986099516.0000000004E02000.00000004.00000001.sdmp, rundll32.exe, 00000013.00000002.1180365819.000000000099E000.00000004.00000001.sdmp, rundll32.exe, 00000013.00000003.1152320566.000000000099E000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000002.1162891462.000001EEEB300000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000001B.00000002.1162702324.000001EEEAAEB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001B.00000003.1140780623.000001EEEB37F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140862081.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140819437.000001EEEB3C0000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140746669.000001EEEB36E000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140725417.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140840971.000001EEEB3A0000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: Amcache.hve.14.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 00000013.00000002.1180209791.0000000000964000.00000004.00000020.sdmp	String found in binary or memory: https://46.55.222.11/
Source: rundll32.exe, 00000013.00000002.1180209791.0000000000964000.00000004.00000020.sdmp	String found in binary or memory: https://46.55.222.11/8
Source: rundll32.exe, 00000013.00000002.1180209791.0000000000964000.00000004.00000020.sdmp, rundll32.exe, 00000013.00000003.1152435535.0000000000982000.00000004.00000001.sdmp	String found in binary or memory: https://46.55.222.11/MzlIoFkmcKcsrPXYulsIlJCKDmaMDeWzUVWmwgeGIDUlcKy
Source: svchost.exe, 0000001B.00000003.1140780623.000001EEEB37F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140862081.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140819437.000001EEEB3C0000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140746669.000001EEEB36E000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140725417.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140840971.000001EEEB3A0000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000001B.00000003.1140780623.000001EEEB37F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140862081.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140819437.000001EEEB3C0000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140746669.000001EEEB36E000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140725417.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140840971.000001EEEB3A0000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001B.00000003.1140780623.000001EEEB37F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140862081.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140819437.000001EEEB3C0000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140746669.000001EEEB36E000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140725417.000001EEEB35D000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1140840971.000001EEEB3A0000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001B.00000003.1141777467.000001EEEB3C7000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1141862625.000001EEEB363000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1141880820.000001EEEB802000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1141751737.000001EEEB3C7000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1141812043.000001EEEB38F000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000003.1141826114.000001EEEB3B0000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.d12468.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.d12468.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.c40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.c521c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.c521c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.30721c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2fb3548.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.30721c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.c40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2fb3548.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.14e38e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.14e38e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.7d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.da0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.620000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.14e38e8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.1133192472.000000000094A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.939874518.0000000003010000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.919228710.0000000000620000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.939979664.000000000305A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.959570739.00000000014CB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1025809484.0000000000C40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.988196686.0000000001240000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.939715779.00000000007D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.959524190.0000000001240000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.941875842.00000000014CB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.912530116.0000000000DA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.960569853.0000000001240000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.943150196.00000000014CB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.891306491.000000000079A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.936544594.0000000002F9A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1179908495.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.939909741.0000000000C3A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1025975580.0000000000CFA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.988254335.00000000014CB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.960680402.00000000014CB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.942948802.0000000001240000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.941755478.0000000001240000.00000040.00000010.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E551C10 appears 97 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E56D350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E551C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E56D350 appears 33 times

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,bhramccfbdd
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vmizynodtqcc\ubilavwdqio.euv",bFzJjrBOyBxj
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5244 -ip 5244
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 308
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5244 -ip 5244
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 316
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vmizynodtqcc\ubilavwdqio.euv",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,axamexdrqyrgb	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,bhramccfbdd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vmizynodtqcc\ubilavwdqio.euv",bFzJjrBOyBxj	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vmizynodtqcc\ubilavwdqio.euv",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5244 -ip 5244	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 308	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5244 -ip 5244	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 316	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6248:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6204:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5244

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E579153 push ecx; ret	0_2_6E579166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0062150F push ds; ret	3_2_00621527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0062151C push ds; ret	3_2_00621527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E579153 push ecx; ret	3_2_6E579166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00DA151C push ds; ret	4_2_00DA1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00DA150F push ds; ret	4_2_00DA1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_007D151C push ds; ret	7_2_007D1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_007D150F push ds; ret	7_2_007D1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00C4150F push ds; ret	9_2_00C41527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00C4151C push ds; ret	9_2_00C41527

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: rundll32.exe, 00000013.00000002.1180209791.0000000000964000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWp
Source: rundll32.exe, 00000013.00000003.1152435535.0000000000982000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWq
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000011.00000002.987689088.0000000004E05000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.986099516.0000000004E02000.00000004.00000001.sdmp, rundll32.exe, 00000013.00000003.1152435535.0000000000982000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000002.1162702324.000001EEEAAEB000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000002.1162540388.000001EEEAA70000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.me
Source: WerFault.exe, 00000011.00000002.987689088.0000000004E05000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.986099516.0000000004E02000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW,
Source: WerFault.exe, 00000011.00000003.986185428.0000000004DD9000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000002.987658833.0000000004DD9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000011.00000003.984549522.0000000004DD7000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: svchost.exe, 0000001B.00000002.1162714900.000001EEEAAFA000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: Amcache.hve.14.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56C050 mov eax, dword ptr fs:[00000030h]	0_2_6E56C050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56BFE0 mov esi, dword ptr fs:[00000030h]	0_2_6E56BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56BFE0 mov eax, dword ptr fs:[00000030h]	0_2_6E56BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5712CB mov ecx, dword ptr fs:[00000030h]	0_2_6E5712CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E57298C mov eax, dword ptr fs:[00000030h]	0_2_6E57298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00634315 mov eax, dword ptr fs:[00000030h]	3_2_00634315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E56C050 mov eax, dword ptr fs:[00000030h]	3_2_6E56C050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E56BFE0 mov esi, dword ptr fs:[00000030h]	3_2_6E56BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E56BFE0 mov eax, dword ptr fs:[00000030h]	3_2_6E56BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E5712CB mov ecx, dword ptr fs:[00000030h]	3_2_6E5712CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E57298C mov eax, dword ptr fs:[00000030h]	3_2_6E57298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00DB4315 mov eax, dword ptr fs:[00000030h]	4_2_00DB4315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_007E4315 mov eax, dword ptr fs:[00000030h]	7_2_007E4315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00C54315 mov eax, dword ptr fs:[00000030h]	9_2_00C54315

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6E56CB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E56D1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5729E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E5729E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E56CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6E56CB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E56D1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E5729E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E5729E6

Source: loaddll32.exe, 00000000.00000000.960924600.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.959624705.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.941981877.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.943283652.0000000001950000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000002.1182011580.0000000002FF0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.960924600.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.959624705.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.941981877.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.943283652.0000000001950000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000002.1182011580.0000000002FF0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.960924600.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.959624705.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.941981877.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.943283652.0000000001950000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000002.1182011580.0000000002FF0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.960924600.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.959624705.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.941981877.0000000001950000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.943283652.0000000001950000.00000002.00020000.sdmp, rundll32.exe, 00000013.00000002.1182011580.0000000002FF0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Windows Analysis Report TYLNb8VvnmYA.dll

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
104.245.52.73	unknown	United States	63251	METRO-WIRELESSUS	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
51.68.175.8	unknown	France	16276	OVHFR	true
103.8.26.102	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
41.76.108.46	unknown	South Africa	327979	DIAMATRIXZA	true
103.8.26.103	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
212.237.5.209	unknown	Italy	31034	ARUBA-ASNIT	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
210.57.217.132	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.184.25.237	unknown	Turkey	209711	MUVHOSTTR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
104.251.214.46	unknown	United States	54540	INCERO-HVVCUS	true

ID:	532264
Product:	CloudBasic
Start time:	22:25:41
Start date:	01.12.2021
Sample:	TYLNb8VvnmYA.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	2b155f0eb4240dbe18024ca82e2418ca
SHA1:	a84ba84de27be3294350f7428de56355b4417a79
SHA256:	60b8988a2c2fc3f2108ab8cb49d8a7a566f5bcd2036dca941c5863f9085c3a9d
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_88e9c9cb640b4f665f2020b110738337d7578_d70d8aa6_1592a30b\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	FC8023A42EBD208F8FCA620E7924080E	37F06CD08FA8D2BEAD43F9675F1C9C053D102604	8F943259AD1E89ACFF7B2915F21831F43355DF32F885B66BF73211200AC0F7DC
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_d71d33d652a62c864cb684e881f783bcee8c2df7_d70d8aa6_02aad9f9\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	F2456B34FA4E877D17235BA63E511A3C	DAA64B736733D76C387793CE194A78831AAFD9DF	29D9E39133D1ACBBD579869AFD1EA6537D0E2CB6935FD6C4A819550D878DD59A
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9530.tmp.dmp	Mini DuMP crash report, 15 streams, Wed Dec 1 21:28:50 2021, 0x1205a4 type	1CEBA21AA26D42C53AAEE8B4C20DD555	D82AD66A19D060219711119FB10981B80C7E90DF	D850A4581ADC91F6DA0F366A72A1587B395ECA1EB41CD432CABB7D2343DD5B2D
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9976.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	8A21DC4E247014FDFF6354D16785E5C4	D758580517950F33791A82226AFDAD3852F784F8	45FBA0F6786E168F7F9CD6BB8C632DF718AB330A556BCEE6F1DCAEB254ED0CA8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D31.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	D8D7BD38047FCCBE351D209FE52B518E	9888F0CB6409D7BE53909E272117E21F1B5F32C6	C61A042D11258BA4D9506AD20B11098BBD41C1DA135C9F57AB704A7F1D6C7BBC
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB441.tmp.dmp	Mini DuMP crash report, 15 streams, Wed Dec 1 21:28:58 2021, 0x1205a4 type	C2F412D47186EB62CEFB2078AEE62474	7BBC723553491EDD3353DD6129F7D63819255D34	2D0F163965A10EC8195481BD8430CD25B90F7CF813540E290605B670870A3AF2
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDF8.tmp.csv	data	75A311CB5E3C0CC645B885F874A47868	3B451C0A041DA843FAF3446145CC64EAEACE6BA2	E68A0170918043ABDB138A14CC74298C455C24B7A2BBB641566F0755E87C8AD9
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1B2.tmp.txt	data	D567B61A9288D91FC4DEE7658B6C3A15	0095F26A41D09D73F2C18B512C9DAF5CB3A300C0	553DB33FC1601E4B5821CD63ADD0F35822502715FCD181547B7EEC2165900D99
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC614.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	BC1A61966A7DC6C50C406E03D45EDA76	7D2979A2ADEB8BEE776210D982C1573A3D7F8D4E	D89B940DE44BB2C378BE33C90E98564E20F131A33E7A8F4D91046042A9DF4F88
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC903.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	0372A8A89F7E0F2B5D28356C690F9A47	35FF7F57D621DA30427A11F022576A54510EB4BE	B11E04B0033A59A26EDE842D536DE50A19669E5C91300C4C399DE1652D5F3173
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9BD.tmp.csv	data	A0539B80100A5FEE5BDBD286E2745111	AA82F49B2AD8089770078B05101196E1626A6BA5	1FC2ED425D84D7D8B145A2016E7121CCB6CE207F1DAD933A226EA9E5057F90C2
C:\ProgramData\Microsoft\Windows\WER\Temp\WERECDB.tmp.txt	data	55B2782885E16F3337104ABB7EE6FB4C	7F8C0B0A15A8AD2B6D11BD09A67AF4C47CF99F78	62C92ACCE6CA9782358FCAE3386CABFAA88E223E4583883733B1E9E112C09F15
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	DEAE234E5051217DACD82F6713F70683	E9572EA48CB631E3119EC6C38937A6949991F371	F63C81722106969A31F43D344A55ABBE71DC074D9DADFE95F392125AAE24792D
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	F777FB1AF9B00861CE49AB59F0886A91	BAFA3CDC4BE57B07AB48626940059DBB798A646B	680B4228A22FB3254DA7A99C6686C956F1175E004D64484B9B208FE6A2A7E082