Windows Analysis Report
SdEkI4IDqd.exe

Overview

General Information

Sample Name: SdEkI4IDqd.exe
Analysis ID: 559536
MD5: 003a7c37f9c06d75aaaa6f9b25dc3c41
SHA1: a847ef8c72d26731963b189caff925a8a757d563
SHA256: 4f29b22b6b787babc2f984172f8ae0e3999b7621aeb6775ce023f2ef5db0b2e7
Infos:

Detection

GuLoader
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Creates a DirectInput object (often for capturing keystrokes)
Uses 32bit PE files
AV process strings found (often used to terminate AV products)
One or more processes crash
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Detected potential crypto function
PE / OLE file has an invalid certificate
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000002.00000000.334615569450.00000000046A0000.00000040.00000800.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://dariamob.ro/wed/eee_XScUCMEVL47.bin"}
Multi AV Scanner detection for submitted file
Source: SdEkI4IDqd.exe ReversingLabs: Detection: 11%

Compliance
barindex
Uses 32bit PE files
Source: SdEkI4IDqd.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: SdEkI4IDqd.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: CLBCatQ.pdb( source: WerFault.exe, 00000006.00000003.334643079195.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334650934945.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ntmarta.pdb% source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntmarta.pdb( source: WerFault.exe, 00000006.00000003.334646229279.0000000005D93000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334654688118.0000000005D93000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000006.00000003.334627998424.0000000002854000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623351126.0000000002854000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000006.00000003.334638661765.000000000566C000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641760247.000000000566C000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000006.00000003.334630548348.0000000005309000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627358211.0000000005309000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000006.00000003.334628172631.0000000002865000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 00000006.00000003.334627948803.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334622593090.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712001293.0000000004901000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623321245.000000000284E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cryptbase.pdbA source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 00000006.00000003.334676424291.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334681726772.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679956588.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712001293.0000000004901000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdb( source: WerFault.exe, 00000006.00000003.334629064137.000000000567D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334648186253.000000000567D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: userenv.pdb( source: WerFault.exe, 00000006.00000003.334638498888.000000000565B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632159495.000000000565B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000006.00000003.334628128277.000000000285F000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb( source: WerFault.exe, 00000006.00000003.334630548348.0000000005309000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627358211.0000000005309000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: riched20.pdbk source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bcrypt.pdb( source: WerFault.exe, 00000006.00000003.334638661765.000000000566C000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641760247.000000000566C000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: usp10.pdb( source: WerFault.exe, 00000006.00000003.334645390229.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334675936492.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000006.00000003.334646229279.0000000005D93000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334654688118.0000000005D93000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 00000006.00000003.334643079195.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334650934945.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WLDP.pdb( source: WerFault.exe, 00000006.00000003.334640919789.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334671189047.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000006.00000003.334628043555.0000000002859000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000006.00000003.334644924687.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661215483.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: TextShaping.pdb source: WerFault.exe, 00000006.00000003.334683206580.00000000064B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334686124336.00000000064B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: usp10.pdb source: WerFault.exe, 00000006.00000003.334645390229.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334675936492.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shcore.pdbm source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CoreMessaging.pdb( source: WerFault.exe, 00000006.00000003.334676424291.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334681726772.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679956588.0000000006392000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000006.00000003.334629064137.000000000567D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334648186253.000000000567D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: CoreUIComponents.pdb( source: WerFault.exe, 00000006.00000003.334668526803.0000000006338000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679884377.0000000006338000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: oleacc.pdb( source: WerFault.exe, 00000006.00000003.334642118918.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334634677761.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635488090.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645815155.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334629149430.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334651855547.0000000005688000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: advapi32.pdb( source: WerFault.exe, 00000006.00000003.334628128277.000000000285F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: propsys.pdbO source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: userenv.pdbu source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdbg source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wwin32u.pdb( source: WerFault.exe, 00000006.00000003.334630683994.0000000005314000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632969680.0000000005314000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000006.00000003.334627651858.0000000005325000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635658549.0000000005325000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oleacc.pdb) source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: version.pdb# source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: TextShaping.pdb( source: WerFault.exe, 00000006.00000003.334683206580.00000000064B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334686124336.00000000064B2000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: comctl32v582.pdb source: WerFault.exe, 00000006.00000003.334631755703.000000000558D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334639811501.000000000558D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000006.00000003.334632264968.0000000005666000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000006.00000003.334633229612.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627701921.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635697918.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334630919130.000000000532B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000006.00000003.334655100260.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334669235798.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WLDP.pdbs source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000006.00000003.334627998424.0000000002854000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623351126.0000000002854000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msls31.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: TextInputFramework.pdb( source: WerFault.exe, 00000006.00000003.334676233311.00000000062DD000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334678064662.00000000062DD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000006.00000003.334641819621.0000000005672000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645674422.0000000005672000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ole32.pdb( source: WerFault.exe, 00000006.00000003.334627651858.0000000005325000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635658549.0000000005325000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: shcore.pdb( source: WerFault.exe, 00000006.00000003.334654898135.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661290996.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msvcp_win.pdb( source: WerFault.exe, 00000006.00000003.334630495863.0000000005303000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627298226.0000000005303000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Kernel.Appcore.pdb( source: WerFault.exe, 00000006.00000003.334645056560.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334665880795.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shell32.pdb( source: WerFault.exe, 00000006.00000003.334626769511.00000000028F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: propsys.pdb( source: WerFault.exe, 00000006.00000003.334632399665.0000000005677000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645707280.0000000005677000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 00000006.00000003.334654898135.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661290996.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: riched20.pdb source: WerFault.exe, 00000006.00000003.334672930322.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shlwapi.pdb( source: WerFault.exe, 00000006.00000003.334644924687.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661215483.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: apphelp.pdb( source: WerFault.exe, 00000006.00000003.334641819621.0000000005672000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645674422.0000000005672000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000006.00000003.334630739209.000000000531A000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334633037721.000000000531A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oleaut32.pdb( source: WerFault.exe, 00000006.00000003.334656733114.0000000006113000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334672767243.0000000006113000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oleacc.pdb source: WerFault.exe, 00000006.00000003.334642118918.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334634677761.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635488090.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645815155.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334629149430.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334651855547.0000000005688000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 00000006.00000003.334626769511.00000000028F5000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: apphelp.pdb] source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000006.00000003.334630495863.0000000005303000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627298226.0000000005303000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wimm32.pdb( source: WerFault.exe, 00000006.00000003.334638313404.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334628709433.00000000055F4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000006.00000003.334638313404.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334628709433.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: userenv.pdb source: WerFault.exe, 00000006.00000003.334638498888.000000000565B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632159495.000000000565B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000006.00000003.334668526803.0000000006338000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679884377.0000000006338000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000006.00000003.334630683994.0000000005314000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632969680.0000000005314000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 00000006.00000003.334635179965.0000000005661000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641228434.0000000005661000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Windows.Storage.pdb( source: WerFault.exe, 00000006.00000003.334655100260.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334669235798.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: sechost.pdb( source: WerFault.exe, 00000006.00000003.334629683558.00000000028EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334626673231.00000000028EA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: comctl32v582.pdb( source: WerFault.exe, 00000006.00000003.334631755703.000000000558D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334639811501.000000000558D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: combase.pdb( source: WerFault.exe, 00000006.00000003.334633229612.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627701921.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635697918.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334630919130.000000000532B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000006.00000003.334627948803.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334622593090.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623321245.000000000284E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcrt.pdb( source: WerFault.exe, 00000006.00000003.334628172631.0000000002865000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: setupapi.pdb( source: WerFault.exe, 00000006.00000003.334635179965.0000000005661000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641228434.0000000005661000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ws2_32.pdbK source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000006.00000003.334627561731.000000000531F000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 00000006.00000003.334640919789.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334671189047.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000006.00000003.334629683558.00000000028EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334626673231.00000000028EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bcrypt.pdbW source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shfolder.pdb source: WerFault.exe, 00000006.00000003.334637475296.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334658178052.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 00000006.00000003.334632399665.0000000005677000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645707280.0000000005677000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wUxTheme.pdb1 source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 00000006.00000003.334667386223.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334677830294.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334638063386.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 00000006.00000003.334676233311.00000000062DD000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334678064662.00000000062DD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000006.00000003.334645056560.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334665880795.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shfolder.pdb( source: WerFault.exe, 00000006.00000003.334637475296.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334658178052.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000006.00000003.334641452538.0000000005682000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wgdi32.pdb( source: WerFault.exe, 00000006.00000003.334630739209.000000000531A000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334633037721.000000000531A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msctf.pdb( source: WerFault.exe, 00000006.00000003.334667386223.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334677830294.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334638063386.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CLBCatQ.pdby source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shfolder.pdb? source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000006.00000003.334656733114.0000000006113000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334672767243.0000000006113000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: setupapi.pdb[ source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 2_2_00405C49
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_00406873 FindFirstFileW,FindClose, 2_2_00406873
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_0040290B FindFirstFileW, 2_2_0040290B

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://dariamob.ro/wed/eee_XScUCMEVL47.bin
Source: SdEkI4IDqd.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SdEkI4IDqd.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: WerFault.exe, 00000006.00000002.334846106125.0000000002837000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: WerFault.exe, 00000006.00000002.334845899854.0000000002808000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SdEkI4IDqd.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SdEkI4IDqd.exe String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SdEkI4IDqd.exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SdEkI4IDqd.exe String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SdEkI4IDqd.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SdEkI4IDqd.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: SdEkI4IDqd.exe String found in binary or memory: http://ocsp.digicert.com0O
Source: Amcache.hve.6.dr, Amcache.hve.LOG1.6.dr String found in binary or memory: http://upx.sf.net
Source: SdEkI4IDqd.exe String found in binary or memory: http://www.digicert.com/CPS0
Source: SdEkI4IDqd.exe String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: WerFault.exe, 00000006.00000003.334642355623.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: DWM8And16Bit_DirectDrawCreateEx_CallOut
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 2_2_004056DE

System Summary
barindex
Uses 32bit PE files
Source: SdEkI4IDqd.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
One or more processes crash
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 132
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Section loaded: edgegdi.dll Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_0040352D
Detected potential crypto function
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_0040755C 2_2_0040755C
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_00406D85 2_2_00406D85
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_70E71BFF 2_2_70E71BFF
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A584A 2_2_046A584A
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A5855 2_2_046A5855
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A5E2F 2_2_046A5E2F
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A6034 2_2_046A6034
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A801C 2_2_046A801C
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A42ED 2_2_046A42ED
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A82D0 2_2_046A82D0
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A04AF 2_2_046A04AF
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A5CB0 2_2_046A5CB0
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A7D7D 2_2_046A7D7D
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A554A 2_2_046A554A
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A4543 2_2_046A4543
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A5B2F 2_2_046A5B2F
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A4D3E 2_2_046A4D3E
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A5BD9 2_2_046A5BD9
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A6F88 2_2_046A6F88
PE / OLE file has an invalid certificate
Source: SdEkI4IDqd.exe Static PE information: invalid certificate
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A584A NtAllocateVirtualMemory, 2_2_046A584A
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A5855 NtAllocateVirtualMemory, 2_2_046A5855
Source: SdEkI4IDqd.exe ReversingLabs: Detection: 11%
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe File read: C:\Users\user\Desktop\SdEkI4IDqd.exe Jump to behavior
Source: SdEkI4IDqd.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SdEkI4IDqd.exe "C:\Users\user\Desktop\SdEkI4IDqd.exe"
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 132
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_0040352D
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4720
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe File created: C:\Users\user\AppData\Local\Temp\nsp9395.tmp Jump to behavior
Source: classification engine Classification label: mal68.troj.winEXE@2/9@0/0
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_004021AA CoCreateInstance, 2_2_004021AA
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 2_2_0040498A
Source: SdEkI4IDqd.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: CLBCatQ.pdb( source: WerFault.exe, 00000006.00000003.334643079195.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334650934945.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ntmarta.pdb% source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntmarta.pdb( source: WerFault.exe, 00000006.00000003.334646229279.0000000005D93000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334654688118.0000000005D93000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000006.00000003.334627998424.0000000002854000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623351126.0000000002854000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000006.00000003.334638661765.000000000566C000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641760247.000000000566C000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000006.00000003.334630548348.0000000005309000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627358211.0000000005309000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000006.00000003.334628172631.0000000002865000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 00000006.00000003.334627948803.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334622593090.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712001293.0000000004901000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623321245.000000000284E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cryptbase.pdbA source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 00000006.00000003.334676424291.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334681726772.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679956588.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712001293.0000000004901000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdb( source: WerFault.exe, 00000006.00000003.334629064137.000000000567D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334648186253.000000000567D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: userenv.pdb( source: WerFault.exe, 00000006.00000003.334638498888.000000000565B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632159495.000000000565B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000006.00000003.334628128277.000000000285F000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb( source: WerFault.exe, 00000006.00000003.334630548348.0000000005309000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627358211.0000000005309000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: riched20.pdbk source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bcrypt.pdb( source: WerFault.exe, 00000006.00000003.334638661765.000000000566C000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641760247.000000000566C000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: usp10.pdb( source: WerFault.exe, 00000006.00000003.334645390229.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334675936492.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000006.00000003.334646229279.0000000005D93000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334654688118.0000000005D93000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 00000006.00000003.334643079195.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334650934945.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WLDP.pdb( source: WerFault.exe, 00000006.00000003.334640919789.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334671189047.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000006.00000003.334628043555.0000000002859000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000006.00000003.334644924687.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661215483.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: TextShaping.pdb source: WerFault.exe, 00000006.00000003.334683206580.00000000064B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334686124336.00000000064B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: usp10.pdb source: WerFault.exe, 00000006.00000003.334645390229.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334675936492.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shcore.pdbm source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CoreMessaging.pdb( source: WerFault.exe, 00000006.00000003.334676424291.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334681726772.0000000006392000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679956588.0000000006392000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000006.00000003.334629064137.000000000567D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334648186253.000000000567D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: CoreUIComponents.pdb( source: WerFault.exe, 00000006.00000003.334668526803.0000000006338000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679884377.0000000006338000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: oleacc.pdb( source: WerFault.exe, 00000006.00000003.334642118918.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334634677761.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635488090.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645815155.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334629149430.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334651855547.0000000005688000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: advapi32.pdb( source: WerFault.exe, 00000006.00000003.334628128277.000000000285F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: propsys.pdbO source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: userenv.pdbu source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dwmapi.pdbg source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wwin32u.pdb( source: WerFault.exe, 00000006.00000003.334630683994.0000000005314000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632969680.0000000005314000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000006.00000003.334627651858.0000000005325000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635658549.0000000005325000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oleacc.pdb) source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: version.pdb# source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: TextShaping.pdb( source: WerFault.exe, 00000006.00000003.334683206580.00000000064B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334686124336.00000000064B2000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: comctl32v582.pdb source: WerFault.exe, 00000006.00000003.334631755703.000000000558D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334639811501.000000000558D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000006.00000003.334632264968.0000000005666000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000006.00000003.334633229612.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627701921.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635697918.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334630919130.000000000532B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000006.00000003.334655100260.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334669235798.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WLDP.pdbs source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000006.00000003.334627998424.0000000002854000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623351126.0000000002854000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msls31.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: TextInputFramework.pdb( source: WerFault.exe, 00000006.00000003.334676233311.00000000062DD000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334678064662.00000000062DD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000006.00000003.334641819621.0000000005672000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645674422.0000000005672000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ole32.pdb( source: WerFault.exe, 00000006.00000003.334627651858.0000000005325000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635658549.0000000005325000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: shcore.pdb( source: WerFault.exe, 00000006.00000003.334654898135.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661290996.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msvcp_win.pdb( source: WerFault.exe, 00000006.00000003.334630495863.0000000005303000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627298226.0000000005303000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Kernel.Appcore.pdb( source: WerFault.exe, 00000006.00000003.334645056560.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334665880795.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shell32.pdb( source: WerFault.exe, 00000006.00000003.334626769511.00000000028F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: propsys.pdb( source: WerFault.exe, 00000006.00000003.334632399665.0000000005677000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645707280.0000000005677000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 00000006.00000003.334654898135.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661290996.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: riched20.pdb source: WerFault.exe, 00000006.00000003.334672930322.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shlwapi.pdb( source: WerFault.exe, 00000006.00000003.334644924687.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334661215483.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: apphelp.pdb( source: WerFault.exe, 00000006.00000003.334641819621.0000000005672000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645674422.0000000005672000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000006.00000003.334630739209.000000000531A000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334633037721.000000000531A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oleaut32.pdb( source: WerFault.exe, 00000006.00000003.334656733114.0000000006113000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334672767243.0000000006113000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: oleacc.pdb source: WerFault.exe, 00000006.00000003.334642118918.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334634677761.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635488090.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645815155.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334629149430.0000000005688000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334651855547.0000000005688000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 00000006.00000003.334626769511.00000000028F5000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: apphelp.pdb] source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000006.00000003.334630495863.0000000005303000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627298226.0000000005303000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wimm32.pdb( source: WerFault.exe, 00000006.00000003.334638313404.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334628709433.00000000055F4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000006.00000003.334638313404.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334628709433.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: userenv.pdb source: WerFault.exe, 00000006.00000003.334638498888.000000000565B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632159495.000000000565B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000006.00000003.334668526803.0000000006338000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334679884377.0000000006338000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000006.00000003.334630683994.0000000005314000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334632969680.0000000005314000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 00000006.00000003.334635179965.0000000005661000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641228434.0000000005661000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: Windows.Storage.pdb( source: WerFault.exe, 00000006.00000003.334655100260.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334669235798.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: sechost.pdb( source: WerFault.exe, 00000006.00000003.334629683558.00000000028EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334626673231.00000000028EA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: comctl32v582.pdb( source: WerFault.exe, 00000006.00000003.334631755703.000000000558D000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334639811501.000000000558D000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: combase.pdb( source: WerFault.exe, 00000006.00000003.334633229612.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334627701921.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334635697918.000000000532B000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334630919130.000000000532B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000006.00000003.334627948803.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334622593090.000000000284E000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334623321245.000000000284E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcrt.pdb( source: WerFault.exe, 00000006.00000003.334628172631.0000000002865000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: setupapi.pdb( source: WerFault.exe, 00000006.00000003.334635179965.0000000005661000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334641228434.0000000005661000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ws2_32.pdbK source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000006.00000003.334627561731.000000000531F000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 00000006.00000003.334640919789.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334671189047.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000006.00000003.334629683558.00000000028EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334626673231.00000000028EA000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712226163.0000000004AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bcrypt.pdbW source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shfolder.pdb source: WerFault.exe, 00000006.00000003.334637475296.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334658178052.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 00000006.00000003.334632399665.0000000005677000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334645707280.0000000005677000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wUxTheme.pdb1 source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 00000006.00000003.334667386223.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334677830294.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334638063386.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 00000006.00000003.334676233311.00000000062DD000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334678064662.00000000062DD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000006.00000003.334645056560.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334665880795.0000000005DAF000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shfolder.pdb( source: WerFault.exe, 00000006.00000003.334637475296.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334658178052.0000000005D9E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000006.00000003.334641452538.0000000005682000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wgdi32.pdb( source: WerFault.exe, 00000006.00000003.334630739209.000000000531A000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334633037721.000000000531A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: msctf.pdb( source: WerFault.exe, 00000006.00000003.334667386223.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334677830294.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334638063386.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CLBCatQ.pdby source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: shfolder.pdb? source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000006.00000003.334656733114.0000000006113000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000006.00000003.334672767243.0000000006113000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: setupapi.pdb[ source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000006.00000003.334712329389.0000000004AD8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000002.00000000.334615569450.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.334613473567.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.334851169211.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_70E730C0 push eax; ret 2_2_70E730EE
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A304F push es; retn 0010h 2_2_046A305A
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A6436 push edi; retf 2_2_046A643E
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A300E push ecx; ret 2_2_046A300F
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A10AF push edx; ret 2_2_046A10B0
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A6487 push esi; iretd 2_2_046A6488
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A07E3 push cs; retf 2_2_046A07E5
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_70E71BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 2_2_70E71BFF

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe File created: C:\Users\user\AppData\Local\Temp\nsv94A0.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A745A rdtsc 2_2_046A745A
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 2_2_00405C49
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_00406873 FindFirstFileW,FindClose, 2_2_00406873
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_0040290B FindFirstFileW, 2_2_0040290B
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe API call chain: ExitProcess graph end node
Source: WerFault.exe, 00000006.00000002.334846387157.00000000028EB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWh%
Source: WerFault.exe, 00000006.00000002.334848325179.0000000005DBC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver

Anti Debugging
barindex
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A707C mov eax, dword ptr fs:[00000030h] 2_2_046A707C
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A5429 mov eax, dword ptr fs:[00000030h] 2_2_046A5429
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A7D7D mov eax, dword ptr fs:[00000030h] 2_2_046A7D7D
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A41D3 mov eax, dword ptr fs:[00000030h] 2_2_046A41D3
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A6BD6 mov eax, dword ptr fs:[00000030h] 2_2_046A6BD6
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Process queried: DebugPort Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_70E71BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 2_2_70E71BFF
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A745A rdtsc 2_2_046A745A
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_046A89CA RtlAddVectoredExceptionHandler, 2_2_046A89CA
Source: C:\Users\user\Desktop\SdEkI4IDqd.exe Code function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_0040352D

Lowering of HIPS / PFW / Operating System Security Settings
barindex
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.6.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.2107.4-0\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 559536 Sample: SdEkI4IDqd.exe Startdate: 25/01/2022 Architecture: WINDOWS Score: 68 18 Found malware configuration 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Yara detected GuLoader 2->22 24 C2 URLs / IPs found in malware configuration 2->24 6 SdEkI4IDqd.exe 19 2->6         started        process3 file4 12 C:\Users\user\AppData\Local\...\System.dll, PE32 6->12 dropped 14 C:\Users\user\...\OVERROMANTICIZED.dat, DOS 6->14 dropped 9 WerFault.exe 21 16 6->9         started        process5 file6 16 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 9->16 dropped
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://dariamob.ro/wed/eee_XScUCMEVL47.bin true
  • Avira URL Cloud: safe
 unknown