Windows Analysis Report 7MhGa3iotM

Overview

General Information

Sample Name:	7MhGa3iotM (renamed file extension from none to dll)
Analysis ID:	553129
MD5:	752a2613b2b71fc1b99eb611024cc312
SHA1:	7d59cf93d7b7644119b4f2b3742a40f9960c7ca5
SHA256:	2df1bd696a635b1dd0c2aec6a20b12148ccc17023be88a6fa1701896a99e2db0
Tags:	32dllexetrojan
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

Sigma detected: Suspicious Call by Ordinal

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Signatures

AV Detection:

Found malware configuration

Source: 13.2.rundll32.exe.4fa0000.12.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["45.138.98.34:80", "69.16.218.101:8080", "51.210.242.234:8080", "185.148.168.220:8080", "142.4.219.173:8080", "54.38.242.185:443", "191.252.103.16:80", "104.131.62.48:8080", "62.171.178.147:8080", "217.182.143.207:443", "168.197.250.14:80", "37.44.244.177:8080", "66.42.57.149:443", "210.57.209.142:8080", "159.69.237.188:443", "116.124.128.206:8080", "128.199.192.135:8080", "195.154.146.35:443", "185.148.168.15:8080", "195.77.239.39:8080", "207.148.81.119:8080", "85.214.67.203:8080", "190.90.233.66:443", "78.46.73.125:443", "78.47.204.80:443", "37.59.209.141:8080", "54.37.228.122:443"], "Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"]}

Multi AV Scanner detection for submitted file

Source: 7MhGa3iotM.dll	Virustotal: Detection: 29%			Perma Link
Source: 7MhGa3iotM.dll	ReversingLabs: Detection: 41%

Machine Learning detection for sample

Source: 7MhGa3iotM.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 7MhGa3iotM.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.3:49746 -> 45.138.98.34:80
Source: Traffic	Snort IDS: 2404338 ET CNC Feodo Tracker Reported CnC Server TCP group 20 192.168.2.3:49747 -> 69.16.218.101:8080

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 69.16.218.101 144			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.138.98.34 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 45.138.98.34:80
Source: Malware configuration extractor	IPs: 69.16.218.101:8080
Source: Malware configuration extractor	IPs: 51.210.242.234:8080
Source: Malware configuration extractor	IPs: 185.148.168.220:8080
Source: Malware configuration extractor	IPs: 142.4.219.173:8080
Source: Malware configuration extractor	IPs: 54.38.242.185:443
Source: Malware configuration extractor	IPs: 191.252.103.16:80
Source: Malware configuration extractor	IPs: 104.131.62.48:8080
Source: Malware configuration extractor	IPs: 62.171.178.147:8080
Source: Malware configuration extractor	IPs: 217.182.143.207:443
Source: Malware configuration extractor	IPs: 168.197.250.14:80
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 66.42.57.149:443
Source: Malware configuration extractor	IPs: 210.57.209.142:8080
Source: Malware configuration extractor	IPs: 159.69.237.188:443
Source: Malware configuration extractor	IPs: 116.124.128.206:8080
Source: Malware configuration extractor	IPs: 128.199.192.135:8080
Source: Malware configuration extractor	IPs: 195.154.146.35:443
Source: Malware configuration extractor	IPs: 185.148.168.15:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 207.148.81.119:8080
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 190.90.233.66:443
Source: Malware configuration extractor	IPs: 78.46.73.125:443
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 37.59.209.141:8080
Source: Malware configuration extractor	IPs: 54.37.228.122:443

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 207.148.81.119 207.148.81.119
Source: Joe Sandbox View	IP Address: 104.131.62.48 104.131.62.48

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49747 -> 69.16.218.101:8080

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 12

Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101

Source: svchost.exe, 00000014.00000003.394252617.000001B9FBF8C000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000014.00000003.394252617.000001B9FBF8C000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000014.00000003.394269231.000001B9FBF9D000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.394252617.000001B9FBF8C000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000014.00000003.394269231.000001B9FBF9D000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.394252617.000001B9FBF8C000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000014.00000003.394252617.000001B9FBF8C000.00000004.00000001.sdmp	String found in binary or memory: rings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":104380919,"MaxInstallSizeInBytes":203345920,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0","PackageId":"3fbafb47-f476-4c26-4445-49acb9a726e6-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level
Source: svchost.exe, 00000014.00000003.394252617.000001B9FBF8C000.00000004.00000001.sdmp	String found in binary or memory: rings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":104380919,"MaxInstallSizeInBytes":203345920,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0","PackageId":"3fbafb47-f476-4c26-4445-49acb9a726e6-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level

Source: svchost.exe, 00000014.00000002.409679137.000001B9FB6E9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000014.00000002.409679137.000001B9FB6E9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: rundll32.exe, 0000000D.00000003.326561339.0000000005262000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: rundll32.exe, 0000000D.00000003.326561339.0000000005262000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/.1
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000014.00000003.390495752.000001B9FBF7F000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390514239.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390575463.000001B9FBFA0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390534738.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390606876.000001B9FBF5D000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000014.00000003.390495752.000001B9FBF7F000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390514239.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390575463.000001B9FBFA0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390534738.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390606876.000001B9FBF5D000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000014.00000003.390495752.000001B9FBF7F000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390514239.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390575463.000001B9FBFA0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390534738.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390606876.000001B9FBF5D000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000014.00000003.390495752.000001B9FBF7F000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390514239.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390575463.000001B9FBFA0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390534738.000001B9FBFC0000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.390606876.000001B9FBF5D000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000014.00000003.391292817.000001B9FBF7B000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.391452171.000001B9FBF7B000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 5_2_100012D0 recvfrom,

5_2_100012D0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: loaddll32.exe, 00000002.00000002.294900679.00000000010EB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Potential key logger detected (key state polling based)

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_1000FF59 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		5_2_1000FF59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000FF59 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		6_2_1000FF59

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 13.2.rundll32.exe.53a0000.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4ec0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.54f0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.2d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4ef0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5390000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5520000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4e90000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4ac0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.43d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4a90000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5580000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4fa0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.5620000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4c50000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.51a0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4d30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.4d90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5280000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.56b0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4fa0000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5280000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5550000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.56b0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4fd0000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.2d50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4af0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.53a0000.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4480000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.3430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.50f0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4e60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.53d0000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.52e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.51a0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.5620000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.43c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4d00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4af0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.50c0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5550000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4a70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.3430000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.54f0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.50c0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4e30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.51d0000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.53c0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4a90000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4d00000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4e60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4c20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.45d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4c20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.56e0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.880000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4990000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.5390000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.4ec0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.49c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4a40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4b20000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.4990000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.5650000.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.298606993.00000000056B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.294428773.0000000004E31000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.815959143.0000000004E91000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.298670924.00000000056E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.816961696.00000000050F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.297938888.00000000052E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.814399683.0000000002D50000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.815700731.0000000004D00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.815587816.0000000004C51000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.817960495.0000000005651000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.298239999.00000000054F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.297817521.0000000004AF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.297755557.0000000004AC1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.815509685.0000000004C20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.297710814.0000000004A90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.295787483.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.301385832.0000000004A71000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.815776896.0000000004D31000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.817419709.00000000051D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.297893846.0000000005280000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.298028546.0000000005390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.298441375.0000000005550000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.297464641.0000000003430000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.294757561.00000000043D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.816312049.0000000004FD1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.297638381.00000000049C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.298510030.0000000005581000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.816141431.0000000004EF1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.814627918.00000000043C1000.00000020.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.297863633.0000000004B21000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.816054659.0000000004EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.814701416.0000000004480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.294337664.0000000004E00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.297583118.0000000004990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.816243405.0000000004FA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.301361900.0000000004A40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.297668150.0000000004D91000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.294482062.0000000002990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.817244449.00000000051A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.298093850.00000000053C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.295818674.0000000000881000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.815880931.0000000004E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.817694741.00000000053A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.817922483.0000000005620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.816664369.00000000050C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.815012363.00000000045D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.817778819.00000000053D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.298383199.0000000005521000.00000020.00000001.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: 7MhGa3iotM.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Kgiezrb\edgitxrppqaf.tym:Zone.Identifier

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10017BC1 appears 68 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 1001984C appears 48 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10017BC1 appears 68 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1001984C appears 48 times

Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\7MhGa3iotM.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7MhGa3iotM.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kgiezrb\edgitxrppqaf.tym",JFlwYpDQ
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kgiezrb\edgitxrppqaf.tym",DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\7MhGa3iotM.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7MhGa3iotM.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\7MhGa3iotM.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kgiezrb\edgitxrppqaf.tym",JFlwYpDQ	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Kgiezrb\edgitxrppqaf.tym",DllRegisterServer	Jump to behavior

Source: C:\Windows\System32\SgrmBroker.exe	Mutant created: \BaseNamedObjects\Local\SM0:7124:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5952:120:WilError_01

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 7MhGa3iotM.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 7MhGa3iotM.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 7MhGa3iotM.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 7MhGa3iotM.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 7MhGa3iotM.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_10019891 push ecx; ret	5_2_100198A4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_10017C60 push ecx; ret	5_2_10017C73
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_04E408E0 push esp; iretd	5_2_04E408E3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_04E31195 push cs; iretd	5_2_04E31197
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10019891 push ecx; ret	6_2_100198A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017C60 push ecx; ret	6_2_10017C73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_043E08E0 push esp; iretd	6_2_043E08E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_043D1195 push cs; iretd	6_2_043D1197
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04D91195 push cs; iretd	8_2_04D91197
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00881195 push cs; iretd	10_2_00881197
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04A808E0 push esp; iretd	12_2_04A808E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04A71195 push cs; iretd	12_2_04A71197

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Kgiezrb\edgitxrppqaf.tym:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Fackxudzoi\jiileh.ane:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_1000D804 IsIconic,GetWindowPlacement,GetWindowRect,	5_2_1000D804
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_10008B90 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	5_2_10008B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000D804 IsIconic,GetWindowPlacement,GetWindowRect,	6_2_1000D804
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10008B90 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	6_2_10008B90

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.9 %

Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: svchost.exe, 00000014.00000002.409679137.000001B9FB6E9000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.409043034.000001B9FB681000.00000004.00000001.sdmp, svchost.exe, 00000014.00000002.409605085.000001B9FB681000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000014.00000002.409626860.000001B9FB6A4000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW #h

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_04E3F7F7 mov eax, dword ptr fs:[00000030h]	5_2_04E3F7F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_043DF7F7 mov eax, dword ptr fs:[00000030h]	6_2_043DF7F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04D9F7F7 mov eax, dword ptr fs:[00000030h]	8_2_04D9F7F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_0088F7F7 mov eax, dword ptr fs:[00000030h]	10_2_0088F7F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04A7F7F7 mov eax, dword ptr fs:[00000030h]	12_2_04A7F7F7

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_1001C49A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_1001C49A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_10021743 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_10021743
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_100167D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_100167D5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_1001FC21 SetUnhandledExceptionFilter,__encode_pointer,	5_2_1001FC21
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_1001FC43 __decode_pointer,SetUnhandledExceptionFilter,	5_2_1001FC43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001C49A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_1001C49A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021743 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_10021743
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100167D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_100167D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001FC21 SetUnhandledExceptionFilter,__encode_pointer,	6_2_1001FC21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001FC43 __decode_pointer,SetUnhandledExceptionFilter,	6_2_1001FC43

Source: svchost.exe, 00000001.00000002.813903951.0000017F37B90000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.814472998.0000000002FB0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000001.00000002.813903951.0000017F37B90000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.814472998.0000000002FB0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000001.00000002.813903951.0000017F37B90000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.814472998.0000000002FB0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: svchost.exe, 00000001.00000002.813903951.0000017F37B90000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.814472998.0000000002FB0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	5_2_10027704
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,	5_2_1000A803
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	5_2_10023880
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	6_2_10027704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,	6_2_1000A803
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	6_2_10023880

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000003.00000002.813310517.00000187EE63D000.00000004.00000001.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000003.00000002.813369976.00000187EE702000.00000004.00000001.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000003.00000002.813228713.00000187EE613000.00000004.00000001.sdmp, svchost.exe, 00000003.00000002.813369976.00000187EE702000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_100011C0 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,		5_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100011C0 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,		6_2_100011C0

Windows Analysis Report 7MhGa3iotM

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

IP	Domain	Country	ASN	ASN Name	Malicious
207.148.81.119	unknown	United States	20473	AS-CHOOPAUS	true
104.131.62.48	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
191.252.103.16	unknown	Brazil	27715	LocawebServicosdeInternetSABR	true
168.197.250.14	unknown	Argentina	264776	OmarAnselmoRipollTDCNETAR	true
66.42.57.149	unknown	United States	20473	AS-CHOOPAUS	true
185.148.168.15	unknown	Germany	44780	EVERSCALE-ASDE	true
51.210.242.234	unknown	France	16276	OVHFR	true
217.182.143.207	unknown	France	16276	OVHFR	true
69.16.218.101	unknown	United States	32244	LIQUIDWEBUS	true
159.69.237.188	unknown	Germany	24940	HETZNER-ASDE	true
45.138.98.34	unknown	Germany	9009	M247GB	true
116.124.128.206	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
78.46.73.125	unknown	Germany	24940	HETZNER-ASDE	true
37.59.209.141	unknown	France	16276	OVHFR	true
210.57.209.142	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
185.148.168.220	unknown	Germany	44780	EVERSCALE-ASDE	true
54.37.228.122	unknown	France	16276	OVHFR	true
190.90.233.66	unknown	Colombia	18678	INTERNEXASAESPCO	true
142.4.219.173	unknown	Canada	16276	OVHFR	true
54.38.242.185	unknown	France	16276	OVHFR	true
195.154.146.35	unknown	France	12876	OnlineSASFR	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
62.171.178.147	unknown	United Kingdom	51167	CONTABODE	true
128.199.192.135	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true

ID:	553129
Product:	CloudBasic
Start time:	11:06:47
Start date:	14.01.2022
Sample:	7MhGa3iotM
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	752a2613b2b71fc1b99eb611024cc312
SHA1:	7d59cf93d7b7644119b4f2b3742a40f9960c7ca5
SHA256:	2df1bd696a635b1dd0c2aec6a20b12148ccc17023be88a6fa1701896a99e2db0
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 95.65%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, 61414 bytes, 1 file	ACAEDA60C79C6BCAC925EEB3653F45E0	2AAAE490BCDACCC6172240FF1697753B37AC5578	6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	73A83B68EEC56F6FCE5D94AFE5DA3754	C890FCF934893E2C207F0AC9F515F939F961B2CB	BA6B5262B6379BFDB13F8FB878C85EE73D2E7EA8901D062B30787C074408B8BE
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl	data	75C2DE0C97DD15E5AC9CF377585FA04E	BD1A00C70BA04402662C30704E52F724E1EDFE23	E6726753A68B67804E82A85CA857C472E73A8C6F544908A26D72C421CD4CEF8B
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl	data	C2B7134EDA03414935D4BEA1CB0ABB11	8F30DEA4ACDD8349EE72592EB08C80FDD66903C0	8A359453C99992A0DB2003A515696AB1EF23D9269609F79ED1F72D25D8B2F56A
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl	data	E7A6CAE1C5F91225F13E66DE1D75FFCF	23AC2F55B12BEF143E76D1B8E8AC89CB8099C26D	65A61535E5289512E2DE344CD19EE17E79ECFD3618AEB32927EFA320203C16AD
C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001@` (copy)	data	75C2DE0C97DD15E5AC9CF377585FA04E	BD1A00C70BA04402662C30704E52F724E1EDFE23	E6726753A68B67804E82A85CA857C472E73A8C6F544908A26D72C421CD4CEF8B
C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy)	data	C2B7134EDA03414935D4BEA1CB0ABB11	8F30DEA4ACDD8349EE72592EB08C80FDD66903C0	8A359453C99992A0DB2003A515696AB1EF23D9269609F79ED1F72D25D8B2F56A
C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001C8 (copy)	data	E7A6CAE1C5F91225F13E66DE1D75FFCF	23AC2F55B12BEF143E76D1B8E8AC89CB8099C26D	65A61535E5289512E2DE344CD19EE17E79ECFD3618AEB32927EFA320203C16AD
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators	593A937962715FDBD857B705A9988F7F	9AC262E6FD279F69ED37720956C9E545CC6EF56A	9B633FC8F9952A7B752D245CD68447D047A72728075ECEDA08A73D96780A94AE