Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1V4gPPcQvB

Overview

General Information

Sample Name:1V4gPPcQvB (renamed file extension from none to dll)
Analysis ID:626498
MD5:571f80cb1a81eddf1fb399a4cd96582c
SHA1:9e12d3add0890234365af3ea43e94ec9b271aaa1
SHA256:c117963618d01c8c1b37a8dbc31409318e343ae03493569bfa6d66e0ebdf8dbd
Tags:exetrojan
Infos:

Detection

Emotet
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Changes security center settings (notifications, updates, antivirus, firewall)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
IP address seen in connection with other malware
AV process strings found (often used to terminate AV products)
Modifies existing windows services
PE file contains an invalid checksum
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Registers a DLL
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries disk information (often used to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

  • System is w10x64
  • loaddll64.exe (PID: 4400 cmdline: loaddll64.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 6000 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 5752 cmdline: rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • regsvr32.exe (PID: 468 cmdline: regsvr32.exe /s C:\Users\user\Desktop\1V4gPPcQvB.dll MD5: D78B75FC68247E8A63ACBA846182740E)
      • regsvr32.exe (PID: 5856 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IaRzYtpo\ezkFGDxqYAZSnHs.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
    • rundll32.exe (PID: 5876 cmdline: rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 5648 cmdline: rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllUnregisterServer MD5: 73C519F050C20580F8A62C849D49215A)
      • WerFault.exe (PID: 4132 cmdline: C:\Windows\system32\WerFault.exe -u -p 5648 -s 328 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
  • svchost.exe (PID: 2912 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 2596 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3700 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3364 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 5920 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 6056 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • MpCmdRun.exe (PID: 3576 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)
      • conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • svchost.exe (PID: 2376 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 1796 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3920 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3472 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 1008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5520 cmdline: c:\windows\system32\svchost.exe -k localservice -s W32Time MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
00000003.00000002.263780204.0000028684BB0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
    00000005.00000000.271365226.0000000180001000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000005.00000000.270640994.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        00000006.00000002.773682203.0000000002250000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          00000004.00000002.262907713.000002CDD9AE0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            Click to see the 9 entries
            SourceRuleDescriptionAuthorStrings
            4.2.rundll32.exe.2cdd9ae0000.1.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              6.2.regsvr32.exe.2250000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                5.2.rundll32.exe.17ee83e0000.1.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  2.2.regsvr32.exe.2650000.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    6.2.regsvr32.exe.2250000.1.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      Click to see the 9 entries
                      No Sigma rule has matched
                      No Snort rule has matched

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Source: 1V4gPPcQvB.dllVirustotal: Detection: 39%Perma Link
                      Source: https://23.239.0.12/#mWwnAvira URL Cloud: Label: malware
                      Source: https://23.239.0.12/#mWwnVirustotal: Detection: 9%Perma Link
                      Source: unknownHTTPS traffic detected: 23.239.0.12:443 -> 192.168.2.4:49768 version: TLS 1.2
                      Source: 1V4gPPcQvB.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: msacm32.pdb source: rundll32.exe, 00000005.00000002.288099854.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000000.271408142.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772562411.00000000005E4000.00000004.00000010.00020000.00000000.sdmp
                      Source: Binary string: msacm32.pdbGCTL source: rundll32.exe, 00000005.00000002.288099854.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000000.271408142.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772562411.00000000005E4000.00000004.00000010.00020000.00000000.sdmp
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D26C FindFirstFileW,FindNextFileW,FindClose,

                      Networking

                      barindex
                      Source: C:\Windows\System32\svchost.exeDomain query: time.windows.com
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 23.239.0.12 443
                      Source: Joe Sandbox ViewASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
                      Source: Joe Sandbox ViewJA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cookie: FugmN=1OaJHNsAdUG/QzkBn8l1MX1OStLIWhSmSDTLsNs0G4JROfReo0NL2i0rsoPV1BdeVsmfza2ZrH2jSD3A7RlZAGL2uK0/svPSt6ZIg32CfsjbTbW0ICsfqahc/t3Lth+1yAyXf3ONRKl+Mfak1Wl03vOtrPlmVbih4SAz2UEfIfN420oFIrdI8a0S8OWrT5hwMpA5AZisltoDDG6nVH953Xl5+37wlyVhH7IA4+D0WH7cUFGg2cHQx2FIuMMy+HugHL7Dluol3+wTAYyysiCssTwZt77IAw==Host: 23.239.0.12Connection: Keep-AliveCache-Control: no-cache
                      Source: Joe Sandbox ViewIP Address: 23.239.0.12 23.239.0.12
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: svchost.exe, 0000001E.00000003.528934718.0000022770D5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-05-13T10:00:01.2192622Z||.||8adb3f26-c14b-4fc0-afb3-91b3c6daaa3f||1152921505694830749||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                      Source: svchost.exe, 0000001E.00000003.528934718.0000022770D5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-05-13T10:00:01.2192622Z||.||8adb3f26-c14b-4fc0-afb3-91b3c6daaa3f||1152921505694830749||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                      Source: regsvr32.exe, 00000006.00000003.337284150.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.773314883.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.664291854.0000027EC3060000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.586456050.0000022770D00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: svchost.exe, 0000001E.00000002.586405007.00000227704F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                      Source: svchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://help.disneyplus.com.
                      Source: svchost.exe, 00000013.00000002.664068235.0000027EBD8A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663496037.0000027EBD8A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/an
                      Source: svchost.exe, 0000000D.00000002.316006522.000001B252013000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
                      Source: svchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
                      Source: svchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
                      Source: regsvr32.exe, 00000006.00000003.337434707.000000000098D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.337374974.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.337473379.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772921740.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.773078082.000000000098D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://23.239.0.12/
                      Source: regsvr32.exe, 00000006.00000003.337374974.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.337473379.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772921740.0000000000942000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://23.239.0.12/#mWwn
                      Source: svchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
                      Source: svchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
                      Source: svchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
                      Source: svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
                      Source: svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                      Source: svchost.exe, 0000000D.00000002.316082656.000001B252069000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315677209.000001B252067000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
                      Source: svchost.exe, 0000000D.00000003.315690433.000001B252048000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316053651.000001B25204E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
                      Source: svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
                      Source: svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
                      Source: svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
                      Source: svchost.exe, 0000000D.00000002.316043813.000001B252042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315781750.000001B252041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
                      Source: svchost.exe, 0000000D.00000002.316043813.000001B252042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315781750.000001B252041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
                      Source: svchost.exe, 0000000D.00000002.316068130.000001B25205C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
                      Source: svchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://disneyplus.com/legal.
                      Source: svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
                      Source: svchost.exe, 0000000D.00000002.316068130.000001B25205C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
                      Source: svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
                      Source: svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
                      Source: svchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
                      Source: svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
                      Source: svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
                      Source: svchost.exe, 0000001E.00000003.549460027.0000022770DAE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549492713.0000022770D9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549522256.000002277121A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549565055.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549477628.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549508003.0000022770DB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549537697.0000022771202000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.hotspotshield.com/
                      Source: svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
                      Source: svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316006522.000001B252013000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
                      Source: svchost.exe, 0000000D.00000003.315774791.000001B252045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
                      Source: svchost.exe, 0000000D.00000003.315774791.000001B252045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
                      Source: svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
                      Source: svchost.exe, 0000000D.00000002.316033083.000001B25203A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
                      Source: svchost.exe, 0000000D.00000003.315690433.000001B252048000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316053651.000001B25204E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
                      Source: svchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
                      Source: svchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
                      Source: svchost.exe, 0000001E.00000003.549460027.0000022770DAE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549492713.0000022770D9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549522256.000002277121A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549565055.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549477628.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549508003.0000022770DB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549537697.0000022771202000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.hotspotshield.com/terms/
                      Source: svchost.exe, 0000001E.00000003.549460027.0000022770DAE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549492713.0000022770D9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549522256.000002277121A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549565055.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549477628.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549508003.0000022770DB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549537697.0000022771202000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.pango.co/privacy
                      Source: svchost.exe, 0000001E.00000003.558573057.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.558645080.0000022771218000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback
                      Source: unknownDNS traffic detected: queries for: time.windows.com
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800132F0 InternetReadFile,RtlAllocateHeap,
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cookie: FugmN=1OaJHNsAdUG/QzkBn8l1MX1OStLIWhSmSDTLsNs0G4JROfReo0NL2i0rsoPV1BdeVsmfza2ZrH2jSD3A7RlZAGL2uK0/svPSt6ZIg32CfsjbTbW0ICsfqahc/t3Lth+1yAyXf3ONRKl+Mfak1Wl03vOtrPlmVbih4SAz2UEfIfN420oFIrdI8a0S8OWrT5hwMpA5AZisltoDDG6nVH953Xl5+37wlyVhH7IA4+D0WH7cUFGg2cHQx2FIuMMy+HugHL7Dluol3+wTAYyysiCssTwZt77IAw==Host: 23.239.0.12Connection: Keep-AliveCache-Control: no-cache
                      Source: unknownHTTPS traffic detected: 23.239.0.12:443 -> 192.168.2.4:49768 version: TLS 1.2

                      E-Banking Fraud

                      barindex
                      Source: Yara matchFile source: 4.2.rundll32.exe.2cdd9ae0000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2250000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.17ee83e0000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.2650000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2250000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.17ee83e0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.28684bb0000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.2650000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.28684bb0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.2cdd9ae0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000002.263780204.0000028684BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.271365226.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.270640994.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.773682203.0000000002250000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.262907713.000002CDD9AE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.267523987.0000000002650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.262542894.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.262976957.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.271590339.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.267727821.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.288344395.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.773821729.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.287869129.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.270508750.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5648 -s 328
                      Source: C:\Windows\System32\regsvr32.exeFile deleted: C:\Windows\System32\IaRzYtpo\ezkFGDxqYAZSnHs.dll:Zone.IdentifierJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeFile created: C:\Windows\system32\IaRzYtpo\Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E86F0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8E6C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8A77C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8AF70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8FB6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8EB60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8FCA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8AA0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8B5CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8895C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E85944
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00E70000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180010FF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180028C20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002C058
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180009100
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180007958
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000C608
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001E3AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001DBE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001FC0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000580C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180022010
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001481C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002A42C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180011834
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180023831
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021C3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000703C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000AC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000FC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180006458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C05C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001A460
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029888
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D49C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180008CA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800248A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180015CB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800124B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000C4B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800288B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800024B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000D8C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800250CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800190D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017CE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800264F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800014F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020CFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002C904
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017908
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021510
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F917
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000551C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F128
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001CD38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180016D3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001F944
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180018148
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D950
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013150
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001ED50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001E960
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019D60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C964
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180001D68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001496C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002D70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002178
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180024D80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180018598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180003598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002A9A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800119A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180025DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180018DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800269B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800059B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800029BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800141C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800125C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800121CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800075D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800095DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F9E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001FA38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000A270
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019E78
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001DA80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180024698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000EE98
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800176B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001AAB8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180011AD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180008AD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800296EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000A6EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800132F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001BB04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002870C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180026B10
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000131C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000671C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180012F28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000BB28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001EB30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020334
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180010758
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001435C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180009F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020768
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017378
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013780
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180015388
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000338C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000738C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002790
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180027F9C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800197A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002C7B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001DFB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001F7C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800097C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800157D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019FDC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017BDC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F7E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180001FE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180010FF4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002C058
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180009100
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000C608
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180021618
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001E3AC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001DBE8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001FC0C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000580C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180022010
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001481C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002A42C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180011834
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180021C3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000703C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000AC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000FC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180006458
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001C05C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001A460
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180029888
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001D49C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180008CA0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800248A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180015CB0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800124B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000C4B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800288B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800024B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000D8C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800250CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800190D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017CE4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800264F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800014F8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180020CFC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002C904
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017908
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180021510
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F917
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000551C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F128
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001CD38
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180016D3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001F944
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180018148
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001ED50
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180013150
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001D950
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001E960
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019D60
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001C964
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180001D68
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001496C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002D70
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002178
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180024D80
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180018598
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180003598
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002A9A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800119A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180025DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180018DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800269B0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800059B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800029BC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800141C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800125C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800121CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800075D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800095DC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F9E8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002610
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019618
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180013E28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001FA38
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000A270
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019E78
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001DA80
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180024698
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000EE98
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800176B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001AAB8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180011AD0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180008AD8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800296EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000A6EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800132F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019300
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001BB04
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002870C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180026B10
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000131C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000671C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180029B28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180012F28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000BB28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001EB30
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180020334
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180010758
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001435C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180009F5C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180029368
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180020768
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017378
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180013780
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180015388
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000338C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000738C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002790
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800197A0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002C7B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001DFB4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001F7C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800097C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800157D8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019FDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017BDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F7E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180001FE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000028684BA0000
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180010FF4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C058
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180009100
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000C608
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180021618
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001E3AC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001DBE8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001FC0C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000580C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180022010
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001481C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002A42C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180011834
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180021C3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000703C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000AC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000FC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180006458
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001C05C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001A460
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180029888
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001D49C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180008CA0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800248A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180015CB0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800124B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000C4B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800288B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800024B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000D8C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800250CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800190D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017CE4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800264F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800014F8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180020CFC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C904
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017908
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180021510
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F917
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000551C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F128
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001CD38
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180016D3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001F944
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180018148
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001ED50
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180013150
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001D950
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001E960
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019D60
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001C964
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180001D68
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001496C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002D70
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002178
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180024D80
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180018598
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180003598
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002A9A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800119A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180025DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180018DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800269B0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800059B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800029BC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800141C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800125C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800121CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800075D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800095DC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F9E8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002610
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019618
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180013E28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001FA38
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000A270
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019E78
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001DA80
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180024698
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000EE98
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800176B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001AAB8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180011AD0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180008AD8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800296EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000A6EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800132F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019300
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001BB04
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002870C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180026B10
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000131C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000671C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180029B28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180012F28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000BB28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001EB30
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180020334
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180010758
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001435C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180009F5C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180029368
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180020768
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017378
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180013780
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180015388
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000338C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000738C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002790
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800197A0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C7B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001DFB4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001F7C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800097C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800157D8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019FDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017BDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F7E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180001FE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000002CDD9AD0000
                      Source: C:\Windows\System32\rundll32.exeCode function: 5_2_0000017EE6DA0000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_02240000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180010FF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180028C20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002C058
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001ACA4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000551C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180018148
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001496C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000E1E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000C608
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180021618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180013E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002AE44
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D26C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180025278
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000EE98
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800046A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180004ACA
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800132F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180026B10
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001DBE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001FC0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000580C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180022010
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001481C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002A42C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180011834
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180021C3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000703C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000AC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000FC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180006458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001C05C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001A460
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180029888
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001D49C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180008CA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800248A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180015CB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800124B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000C4B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800288B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800024B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D8C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800250CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800190D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180017CE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800264F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800014F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180020CFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180009100
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002C904
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180017908
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180021510
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000F917
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000F128
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001CD38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180016D3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001F944
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001D950
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180013150
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001ED50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001E960
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019D60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001C964
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001C568
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180001D68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180002D70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024574
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180002178
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024D80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180018598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180003598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001F1A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002A9A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800119A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180025DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180018DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800269B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800059B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800029BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800141C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800125C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800121CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000BDD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800075D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800095DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000F9E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180002610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001FA38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000A270
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019E78
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001DA80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800176B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001AAB8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002CAD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180011AD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180008AD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800296EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000A6EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001BB04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002870C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000131C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000671C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180029B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180012F28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000BB28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001EB30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180020334
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180010758
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001435C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180009F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180029368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180020768
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180017378
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180013780
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180015388
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dll
                      Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dll
                      Source: 1V4gPPcQvB.dllVirustotal: Detection: 39%
                      Source: 1V4gPPcQvB.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\1V4gPPcQvB.dll
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllRegisterServer
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllUnregisterServer
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IaRzYtpo\ezkFGDxqYAZSnHs.dll"
                      Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5648 -s 328
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
                      Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                      Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s W32Time
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\1V4gPPcQvB.dll
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllRegisterServer
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllUnregisterServer
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IaRzYtpo\ezkFGDxqYAZSnHs.dll"
                      Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32
                      Source: C:\Windows\System32\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9BC.tmpJump to behavior
                      Source: classification engineClassification label: mal88.troj.evad.winDLL@29/10@2/3
                      Source: C:\Windows\System32\regsvr32.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800046A8 CreateToolhelp32Snapshot,Process32NextW,Process32FirstW,FindCloseChangeNotification,
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5648
                      Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2380:120:WilError_01
                      Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: 1V4gPPcQvB.dllStatic PE information: Image base 0x180000000 > 0x60000000
                      Source: 1V4gPPcQvB.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: msacm32.pdb source: rundll32.exe, 00000005.00000002.288099854.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000000.271408142.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772562411.00000000005E4000.00000004.00000010.00020000.00000000.sdmp
                      Source: Binary string: msacm32.pdbGCTL source: rundll32.exe, 00000005.00000002.288099854.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000000.271408142.0000006E56AF5000.00000004.00000010.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772562411.00000000005E4000.00000004.00000010.00020000.00000000.sdmp
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001AFFD push ebp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001BA32 push ebp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001B694 push es; ret
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001BADD push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001B717 push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001AF4E push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001AFFD push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001BA32 push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001B694 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001BADD push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001B717 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180007B3F push esp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001AF4E push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001AFFD push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001BA32 push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001B694 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001BADD push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001B717 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180007B3F push esp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001AF4E push ebp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180007B3F push esp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E87BE8 DecodePointer,_errno,LoadLibraryA,GetProcAddress,_errno,GetLastError,GetLastError,EncodePointer,FreeLibrary,_errno,_errno,
                      Source: 1V4gPPcQvB.dllStatic PE information: real checksum: 0x85ab6 should be: 0x872c4
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\1V4gPPcQvB.dll
                      Source: C:\Windows\System32\regsvr32.exePE file moved: C:\Windows\System32\IaRzYtpo\ezkFGDxqYAZSnHs.dllJump to behavior
                      Source: C:\Windows\System32\svchost.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\ConfigJump to behavior

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Source: C:\Windows\System32\regsvr32.exeFile opened: C:\Windows\system32\IaRzYtpo\ezkFGDxqYAZSnHs.dll:Zone.Identifier read attributes | delete
                      Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\system32\CkyfgNwThSEvXT\vVXecNoxpaDSA.dll:Zone.Identifier read attributes | delete
                      Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\system32\ElRxtMtTRpzOd\RJlBeDFdZK.dll:Zone.Identifier read attributes | delete
                      Source: C:\Windows\System32\WerFault.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\svchost.exe TID: 3000Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 3000Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 5332Thread sleep time: -90000s >= -30000s
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\regsvr32.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
                      Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                      Source: C:\Windows\System32\regsvr32.exeProcess information queried: ProcessInformation
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D26C FindFirstFileW,FindNextFileW,FindClose,
                      Source: C:\Windows\System32\regsvr32.exeAPI call chain: ExitProcess graph end node
                      Source: C:\Windows\System32\regsvr32.exeFile Volume queried: C:\ FullSizeInformation
                      Source: C:\Windows\System32\rundll32.exeFile Volume queried: C:\ FullSizeInformation
                      Source: svchost.exe, 00000013.00000002.664291854.0000027EC3060000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @Hyper-V RAW
                      Source: regsvr32.exe, 00000006.00000003.337434707.000000000098D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.337374974.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.337473379.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772921740.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.773078082.000000000098D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.664277673.0000027EC3053000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.663883740.0000027EBD829000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.586405007.00000227704F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: svchost.exe, 00000009.00000002.772740337.000002DD63A02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
                      Source: rundll32.exe, 00000004.00000002.262803256.000002CDD9958000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}
                      Source: svchost.exe, 00000009.00000002.772901709.000002DD63A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.772926658.00000262D3024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.772958785.000001F6FE629000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: svchost.exe, 0000001E.00000002.584094089.00000227704A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW gOp'
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E820E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E87BE8 DecodePointer,_errno,LoadLibraryA,GetProcAddress,_errno,GetLastError,GetLastError,EncodePointer,FreeLibrary,_errno,_errno,
                      Source: C:\Windows\System32\loaddll64.exeProcess queried: DebugPort
                      Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPort
                      Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPort
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8D318 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E820E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E86550 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Source: C:\Windows\System32\svchost.exeDomain query: time.windows.com
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 23.239.0.12 443
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,free,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoA,GetLocaleInfoA,GetACP,
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s,
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E84558 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFFE2E8E6C0 _lock,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

                      Lowering of HIPS / PFW / Operating System Security Settings

                      barindex
                      Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
                      Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
                      Source: svchost.exe, 00000010.00000002.772933188.000001F18B040000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
                      Source: svchost.exe, 00000010.00000002.773075933.000001F18B102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.772881349.000001F18B02A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

                      Stealing of Sensitive Information

                      barindex
                      Source: Yara matchFile source: 4.2.rundll32.exe.2cdd9ae0000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2250000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.17ee83e0000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.2650000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2250000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.17ee83e0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.28684bb0000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.2650000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.28684bb0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.17ee83e0000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.2cdd9ae0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000002.263780204.0000028684BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.271365226.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.270640994.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.773682203.0000000002250000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.262907713.000002CDD9AE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.267523987.0000000002650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.262542894.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.262976957.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.271590339.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.267727821.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.288344395.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.773821729.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.287869129.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.270508750.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid Accounts1
                      Windows Management Instrumentation
                      1
                      DLL Side-Loading
                      1
                      DLL Side-Loading
                      1
                      Disable or Modify Tools
                      OS Credential Dumping2
                      System Time Discovery
                      Remote Services1
                      Archive Collected Data
                      Exfiltration Over Other Network Medium2
                      Ingress Tool Transfer
                      Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default Accounts2
                      Native API
                      1
                      Windows Service
                      1
                      Windows Service
                      1
                      Obfuscated Files or Information
                      LSASS Memory2
                      File and Directory Discovery
                      Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
                      Encrypted Channel
                      Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)111
                      Process Injection
                      1
                      DLL Side-Loading
                      Security Account Manager34
                      System Information Discovery
                      SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
                      Non-Application Layer Protocol
                      Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
                      File Deletion
                      NTDS1
                      Query Registry
                      Distributed Component Object ModelInput CaptureScheduled Transfer3
                      Application Layer Protocol
                      SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script2
                      Masquerading
                      LSA Secrets51
                      Security Software Discovery
                      SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common3
                      Virtualization/Sandbox Evasion
                      Cached Domain Credentials3
                      Virtualization/Sandbox Evasion
                      VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items111
                      Process Injection
                      DCSync2
                      Process Discovery
                      Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                      Hidden Files and Directories
                      Proc Filesystem1
                      Remote System Discovery
                      Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                      Regsvr32
                      /etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
                      Rundll32
                      Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 626498 Sample: 1V4gPPcQvB Startdate: 14/05/2022 Architecture: WINDOWS Score: 88 48 Multi AV Scanner detection for domain / URL 2->48 50 Antivirus detection for URL or domain 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Yara detected Emotet 2->54 7 loaddll64.exe 1 2->7         started        9 svchost.exe 2->9         started        12 svchost.exe 2->12         started        14 10 other processes 2->14 process3 dnsIp4 17 regsvr32.exe 5 7->17         started        20 cmd.exe 1 7->20         started        22 rundll32.exe 2 7->22         started        24 rundll32.exe 7->24         started        56 Changes security center settings (notifications, updates, antivirus, firewall) 9->56 26 MpCmdRun.exe 1 9->26         started        58 System process connects to network (likely due to code injection or exploit) 12->58 42 127.0.0.1 unknown unknown 14->42 44 time.windows.com 14->44 signatures5 process6 signatures7 46 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->46 28 regsvr32.exe 17->28         started        32 rundll32.exe 2 20->32         started        34 WerFault.exe 20 9 24->34         started        36 conhost.exe 26->36         started        process8 dnsIp9 38 23.239.0.12, 443, 49768 LINODE-APLinodeLLCUS United States 28->38 60 System process connects to network (likely due to code injection or exploit) 28->60 62 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->62 40 192.168.2.1 unknown unknown 34->40 signatures10

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand
                      SourceDetectionScannerLabelLink
                      1V4gPPcQvB.dll40%VirustotalBrowse
                      No Antivirus matches
                      SourceDetectionScannerLabelLinkDownload
                      5.2.rundll32.exe.17ee83e0000.1.unpack100%AviraHEUR/AGEN.1215493Download File
                      2.2.regsvr32.exe.2650000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      5.0.rundll32.exe.17ee83e0000.4.unpack100%AviraHEUR/AGEN.1215493Download File
                      6.2.regsvr32.exe.2250000.1.unpack100%AviraHEUR/AGEN.1215493Download File
                      5.0.rundll32.exe.17ee83e0000.1.unpack100%AviraHEUR/AGEN.1215493Download File
                      3.2.rundll32.exe.28684bb0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      4.2.rundll32.exe.2cdd9ae0000.1.unpack100%AviraHEUR/AGEN.1215493Download File
                      No Antivirus matches
                      SourceDetectionScannerLabelLink
                      https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
                      http://crl.ver)0%Avira URL Cloudsafe
                      https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
                      https://%s.xboxlive.com0%URL Reputationsafe
                      https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
                      https://dynamic.t0%URL Reputationsafe
                      https://www.pango.co/privacy0%URL Reputationsafe
                      https://disneyplus.com/legal.0%URL Reputationsafe
                      https://23.239.0.12/0%URL Reputationsafe
                      https://23.239.0.12/#mWwn10%VirustotalBrowse
                      https://23.239.0.12/#mWwn100%Avira URL Cloudmalware
                      http://help.disneyplus.com.0%URL Reputationsafe
                      https://%s.dnet.xboxlive.com0%URL Reputationsafe
                      NameIPActiveMaliciousAntivirus DetectionReputation
                      time.windows.com
                      unknown
                      unknownfalse
                        high
                        NameMaliciousAntivirus DetectionReputation
                        https://23.239.0.12/true
                        • URL Reputation: safe
                        unknown
                        NameSourceMaliciousAntivirus DetectionReputation
                        https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                          high
                          https://www.disneyplus.com/legal/your-california-privacy-rightssvchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          unknown
                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 0000000D.00000003.315774791.000001B252045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpfalse
                            high
                            https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpfalse
                              high
                              https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                                high
                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpfalse
                                  high
                                  https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 0000000D.00000002.316082656.000001B252069000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315677209.000001B252067000.00000004.00000020.00020000.00000000.sdmpfalse
                                    high
                                    https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 0000000D.00000003.315690433.000001B252048000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316053651.000001B25204E000.00000004.00000020.00020000.00000000.sdmpfalse
                                      high
                                      https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpfalse
                                        high
                                        https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpfalse
                                          high
                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 0000000D.00000003.315774791.000001B252045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpfalse
                                            high
                                            https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                                              high
                                              http://crl.ver)svchost.exe, 0000001E.00000002.586405007.00000227704F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              low
                                              https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 0000000D.00000002.316068130.000001B25205C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpfalse
                                                high
                                                https://www.tiktok.com/legal/report/feedbacksvchost.exe, 0000001E.00000003.558573057.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.558645080.0000022771218000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                unknown
                                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316006522.000001B252013000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  high
                                                  http://schemas.xmlsoap.org/ws/2004/08/addressing/role/ansvchost.exe, 00000013.00000002.664068235.0000027EBD8A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663496037.0000027EBD8A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    high
                                                    https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 0000000D.00000002.316043813.000001B252042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315781750.000001B252041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      high
                                                      https://%s.xboxlive.comsvchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      low
                                                      https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000D.00000003.315690433.000001B252048000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316053651.000001B25204E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        high
                                                        https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          high
                                                          https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            high
                                                            https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              high
                                                              https://support.hotspotshield.com/svchost.exe, 0000001E.00000003.549460027.0000022770DAE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549492713.0000022770D9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549522256.000002277121A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549565055.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549477628.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549508003.0000022770DB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549537697.0000022771202000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                high
                                                                https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  high
                                                                  https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    high
                                                                    https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      high
                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 0000000D.00000002.316068130.000001B25205C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        high
                                                                        https://www.disneyplus.com/legal/privacy-policysvchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          high
                                                                          https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 0000000D.00000002.316043813.000001B252042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315781750.000001B252041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            high
                                                                            https://dynamic.tsvchost.exe, 0000000D.00000003.315743706.000001B252040000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            unknown
                                                                            https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              high
                                                                              https://www.hotspotshield.com/terms/svchost.exe, 0000001E.00000003.549460027.0000022770DAE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549492713.0000022770D9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549522256.000002277121A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549565055.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549477628.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549508003.0000022770DB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549537697.0000022771202000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                high
                                                                                https://www.pango.co/privacysvchost.exe, 0000001E.00000003.549460027.0000022770DAE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549492713.0000022770D9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549522256.000002277121A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549565055.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549477628.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549508003.0000022770DB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.549537697.0000022771202000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://disneyplus.com/legal.svchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 0000000D.00000002.316033083.000001B25203A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.293959173.000001B252031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  high
                                                                                  https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    high
                                                                                    https://23.239.0.12/#mWwnregsvr32.exe, 00000006.00000003.337374974.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.337473379.0000000000942000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.772921740.0000000000942000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                    • 10%, Virustotal, Browse
                                                                                    • Avira URL Cloud: malware
                                                                                    unknown
                                                                                    https://activity.windows.comsvchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      high
                                                                                      http://www.bingmapsportal.comsvchost.exe, 0000000D.00000002.316006522.000001B252013000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        high
                                                                                        https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 0000000D.00000003.315708740.000001B252060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          high
                                                                                          http://help.disneyplus.com.svchost.exe, 0000001E.00000003.553856302.0000022770D8B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.554000176.0000022770DAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001E.00000003.553927952.0000022770D9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          unknown
                                                                                          https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000D.00000002.316037809.000001B25203D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            high
                                                                                            https://%s.dnet.xboxlive.comsvchost.exe, 0000000A.00000002.773524002.0000023F17E43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            low
                                                                                            https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 0000000D.00000003.315726639.000001B25205A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              high
                                                                                              • No. of IPs < 25%
                                                                                              • 25% < No. of IPs < 50%
                                                                                              • 50% < No. of IPs < 75%
                                                                                              • 75% < No. of IPs
                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                              23.239.0.12
                                                                                              unknownUnited States
                                                                                              63949LINODE-APLinodeLLCUStrue
                                                                                              IP
                                                                                              192.168.2.1
                                                                                              127.0.0.1
                                                                                              Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                              Analysis ID:626498
                                                                                              Start date and time: 14/05/202205:00:092022-05-14 05:00:09 +02:00
                                                                                              Joe Sandbox Product:CloudBasic
                                                                                              Overall analysis duration:0h 11m 22s
                                                                                              Hypervisor based Inspection enabled:false
                                                                                              Report type:light
                                                                                              Sample file name:1V4gPPcQvB (renamed file extension from none to dll)
                                                                                              Cookbook file name:default.jbs
                                                                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                              Number of analysed new started processes analysed:38
                                                                                              Number of new started drivers analysed:0
                                                                                              Number of existing processes analysed:0
                                                                                              Number of existing drivers analysed:0
                                                                                              Number of injected processes analysed:0
                                                                                              Technologies:
                                                                                              • HCA enabled
                                                                                              • EGA enabled
                                                                                              • HDC enabled
                                                                                              • AMSI enabled
                                                                                              Analysis Mode:default
                                                                                              Analysis stop reason:Timeout
                                                                                              Detection:MAL
                                                                                              Classification:mal88.troj.evad.winDLL@29/10@2/3
                                                                                              EGA Information:
                                                                                              • Successful, ratio: 100%
                                                                                              HDC Information:Failed
                                                                                              HCA Information:
                                                                                              • Successful, ratio: 99%
                                                                                              • Number of executed functions: 0
                                                                                              • Number of non-executed functions: 0
                                                                                              Cookbook Comments:
                                                                                              • Adjust boot time
                                                                                              • Enable AMSI
                                                                                              • Override analysis time to 240s for rundll32
                                                                                              • Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                                                              • Excluded IPs from analysis (whitelisted): 52.182.143.212, 23.211.4.86, 20.223.24.244, 20.101.57.9, 40.119.148.38
                                                                                              • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, twc.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, onedsblobprdcus15.centralus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                              TimeTypeDescription
                                                                                              05:01:36API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                              05:01:52API Interceptor11x Sleep call for process: svchost.exe modified
                                                                                              05:02:45API Interceptor1x Sleep call for process: MpCmdRun.exe modified
                                                                                              No context
                                                                                              No context
                                                                                              No context
                                                                                              No context
                                                                                              No context
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):8192
                                                                                              Entropy (8bit):0.3593198815979092
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                                                                                              MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                                                                                              SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                                                                                              SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                                                                                              SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                                                                                              Malicious:false
                                                                                              Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:MPEG-4 LOAS
                                                                                              Category:dropped
                                                                                              Size (bytes):1310720
                                                                                              Entropy (8bit):0.24940809595732638
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4e:BJiRdwfu2SRU4e
                                                                                              MD5:BC03F87450CAEF7414858738861111C9
                                                                                              SHA1:08035A774E99C7ABED6814D2974C8A901E814383
                                                                                              SHA-256:BD6BBA61D22F606623D63796ACFC499189497A30613918BCBFDCC3775022CEA5
                                                                                              SHA-512:E57522EDEECB25C54F5530818D25C45CFEAAD74C713354EF508D12CC74EFC168CF1B8DEB5A71FE6C544CC5A81ED9CC0132552401FFDE479338DADE41EFFE33AF
                                                                                              Malicious:false
                                                                                              Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0xd6242f42, page size 16384, Windows version 10.0
                                                                                              Category:dropped
                                                                                              Size (bytes):786432
                                                                                              Entropy (8bit):0.25057302088855365
                                                                                              Encrypted:false
                                                                                              SSDEEP:384:Qbt+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:QbOSB2nSB2RSjlK/+mLesOj1J2
                                                                                              MD5:F57C9D57DEE6DB678E3E38107FF53EA1
                                                                                              SHA1:310CC04A1D5B7CC730D852D552D903E47D51CB61
                                                                                              SHA-256:060A628E2DD9373DDCA713896F09DF358F72830AB6084A62ED5080F565FD2B99
                                                                                              SHA-512:AC15D6FEDFD700EDFD6C2DFEF964E7BD61DB1B2F30EAEE47101B3547F56D5D90FF5F08D7D7AA21D737A1113484E2EF1F67FBD18DC6B3B7CFC399665F42B72C89
                                                                                              Malicious:false
                                                                                              Preview:.$/B... ................e.f.3...w........................)..........z..4....zg.h.(..........z....)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................^N>......z....................g$.....z..........................................................................................................................................................................................................................................................................................................................................................................................
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):16384
                                                                                              Entropy (8bit):0.07544819377032436
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:6WlR7vRzm0lzx+xl/ykVlAll3Vkttlmlnl:JrAcVmgkPA3
                                                                                              MD5:185001A828D26FADCBFEDB0D6E7E10ED
                                                                                              SHA1:306D21732F7309D813AEC541BEB67CCEED87840D
                                                                                              SHA-256:0A58D954C47CFDB49D2B72A952F536A0230F2CFC6BCFB127082C6DE0A2EEB386
                                                                                              SHA-512:3F32AC6CA76F37DFAE7D5D828085EF076F46CD29CC2E2DC5D1E5D15B78731C83A142F7F3617BC5E1509C6FB30817496E3AF77D50AADFC0F18FE3A659FD91B147
                                                                                              Malicious:false
                                                                                              Preview:.........................................3...w..4....zg......z...............z.......z...I.......z....................g$.....z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):65536
                                                                                              Entropy (8bit):0.785480114055903
                                                                                              Encrypted:false
                                                                                              SSDEEP:192:BYgi+JKbHK7gPri4jJ9/u7sSS274lt7M:biAK7K7gPri4jT/u7sSX4lt7M
                                                                                              MD5:34CD300BF58EE32964F064BE71BBEBCF
                                                                                              SHA1:70EF4FFF551A56E8570A6F4DA3AE1E1622E9AAB1
                                                                                              SHA-256:F43EC09912F4B0DAAEF667CBC9C6594DCE0364B9AA85380A449FE55DA8491929
                                                                                              SHA-512:38F233A314D545CE47D8655A03E750C4B527B1500297A92D7EB2E14E229763698A7FF08D760CFCDAF5F9BD451F257E85317FED3CF33334B7CFB86C6DDB6504C4
                                                                                              Malicious:false
                                                                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.6.9.7.0.8.9.1.7.6.5.1.1.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.6.9.7.0.8.9.3.1.0.8.8.6.8.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.0.d.a.a.4.c.-.4.0.f.2.-.4.8.d.6.-.b.f.2.6.-.9.2.e.a.f.9.7.5.b.d.1.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.f.1.0.3.b.a.7.-.4.8.6.2.-.4.d.0.0.-.9.0.c.7.-.9.3.4.9.f.e.3.e.c.5.e.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.1.V.4.g.P.P.c.Q.v.B...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.1.0.-.0.0.0.1.-.0.0.1.c.-.3.5.1.e.-.d.8.e.5.3.e.6.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.c.7.d.0.0.7.0.6.!.
                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                              File Type:Mini DuMP crash report, 15 streams, Sat May 14 03:01:32 2022, 0x1205a4 type
                                                                                              Category:dropped
                                                                                              Size (bytes):64070
                                                                                              Entropy (8bit):2.297301210824416
                                                                                              Encrypted:false
                                                                                              SSDEEP:384:NFgvroVo9ACfWD6lFFpcxjcoGvRXnS2IITgGL9Uiks/aIMyq7QEh14G:Nj9CfWDel1R+xyeNhV
                                                                                              MD5:CFE0137077F96ED63B26DC9BE27BD0C0
                                                                                              SHA1:E1852F02927BA420E72588052AFCA487DC767F59
                                                                                              SHA-256:89A74D5A6A2354AD5727402F1C5FBB7925327A0BF31A3A9667EAADFA569A0411
                                                                                              SHA-512:54BC3CAF99C2F3EC7644AAF817D2641CA9DD1EC634267F54E4458FA900DD303826C03A330258CF275AECA0158D154A786ADAB303C6E2BFCFEB96E8EFA1842A1A
                                                                                              Malicious:false
                                                                                              Preview:MDMP....... ..........b....................................|...8.......D...L;..........`.......8...........T...........X................"...........$...................................................................U...........B......8%......Lw......................T..............b.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                              File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):6662
                                                                                              Entropy (8bit):3.7195466670040447
                                                                                              Encrypted:false
                                                                                              SSDEEP:192:Rrl7r3GLNiCYKuM4/Y7OS0C+pr/89b7SOfWpm:RrlsNilKuM4/Y7OS0u7Lfp
                                                                                              MD5:95D34C845A0AFFA283EDA0A8E9C6B067
                                                                                              SHA1:5E5333B858E39167C24E99462707EDF9B7B84D12
                                                                                              SHA-256:29F2E9F2D6AA1CA3F7AB1F50EA9E9B8B5C93BFCEF90435E9ADE43240E935F6D4
                                                                                              SHA-512:49E8E5E7606213714048B8DE501380122AC848F54D25B6653E4B65CD6423885DFC5EDEF77B816F5F759EE8E8EE8BD09CE9D84D5000857F5CDE0588769EF5FAC5
                                                                                              Malicious:false
                                                                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.4.8.<./.P.i.d.>.......
                                                                                              Process:C:\Windows\System32\WerFault.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):4892
                                                                                              Entropy (8bit):4.500930366414329
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:cvIwSD8zsZrJgtBI9o2Wgc8sqYjY8fm8M4JCdCkenFr8Uyq8vhkeWTZESC5Sad:uITfbOXgrsqY5Jt8UWITVvad
                                                                                              MD5:98CD4DEE7BC8B0D402897E3C238D7811
                                                                                              SHA1:D605FCD150A02FDC33A2AC4FF08593312CC0DB32
                                                                                              SHA-256:2E664FCAABCA386635250AC85194B1A5775E8F281B9DA432403137F1370986FB
                                                                                              SHA-512:C865DD383148167354B4FBD9727F1A0D1D90F3B96FDB7F78C9C302A041572B6942BB9EDA97BC3B93A3D4C14EBC4DB97ADC918A47F1763E174413540C8A0F8659
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1514172" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:ASCII text, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):55
                                                                                              Entropy (8bit):4.306461250274409
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                              Malicious:false
                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}
                                                                                              Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                              Category:modified
                                                                                              Size (bytes):10844
                                                                                              Entropy (8bit):3.1621059961426097
                                                                                              Encrypted:false
                                                                                              SSDEEP:192:cY+38+DJM+i2Jt+iDQ+yw+f0+rU+0Jtk+EOtF+E7tC+EwO+J:j+s+i+Z+z+B+c+Y+0g+J+j+S+J
                                                                                              MD5:983F11DFBDB0C827769458C5B225B661
                                                                                              SHA1:2517C93889D20D0D8A8EC2463C954274B7CB0A8A
                                                                                              SHA-256:25A6753E081DF893B044243C543F9A7D2CA99793C7C155E137D6391325483A38
                                                                                              SHA-512:AD859934A4106BBE862400DBCED55759DE012E1542FA3081A0DB9B81BDD7A451C289F8759B28AF0EEA054C73CE3E12DE953006D532AA1D4D020250BBA142B707
                                                                                              Malicious:false
                                                                                              Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.
                                                                                              File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                              Entropy (8bit):6.482090630678764
                                                                                              TrID:
                                                                                              • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
                                                                                              • Win64 Executable (generic) (12005/4) 10.17%
                                                                                              • Generic Win/DOS Executable (2004/3) 1.70%
                                                                                              • DOS Executable Generic (2002/1) 1.70%
                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
                                                                                              File name:1V4gPPcQvB.dll
                                                                                              File size:545280
                                                                                              MD5:571f80cb1a81eddf1fb399a4cd96582c
                                                                                              SHA1:9e12d3add0890234365af3ea43e94ec9b271aaa1
                                                                                              SHA256:c117963618d01c8c1b37a8dbc31409318e343ae03493569bfa6d66e0ebdf8dbd
                                                                                              SHA512:c17ffc3ab5c68a2371eb0b92063294756b0df3f235caa18bea538082feb6126202d9389cd2bd362b77ad8ec84b371f33e63879756d07fc2ea99ab80bc48ee4b5
                                                                                              SSDEEP:12288:B4UJY9B+TenWsSEPHjMOUP9uXdt7JpfYNVr9RM54RutCTdJGqIoTCZ4eEsZTHxHy:B4UJY9BSenZSEPHjMOUP9Udt7JpfYNVH
                                                                                              TLSH:47C4CFA5435C08FCE762C3395C975BC5B1F7BDAE0664AF260BC18DA05E1BA90F53A381
                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.H.v.&.v.&.v.&.h...o.&.h...2.&.h.....&.Q6].s.&.v.'.9.&.h...w.&.h...w.&.h...w.&.h...w.&.Richv.&.........PE..d.....}b.........."
                                                                                              Icon Hash:74f0e4ecccdce0e4
                                                                                              Entrypoint:0x1800423a8
                                                                                              Entrypoint Section:.text
                                                                                              Digitally signed:false
                                                                                              Imagebase:0x180000000
                                                                                              Subsystem:windows gui
                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                              Time Stamp:0x627D8598 [Thu May 12 22:09:28 2022 UTC]
                                                                                              TLS Callbacks:
                                                                                              CLR (.Net) Version:
                                                                                              OS Version Major:5
                                                                                              OS Version Minor:2
                                                                                              File Version Major:5
                                                                                              File Version Minor:2
                                                                                              Subsystem Version Major:5
                                                                                              Subsystem Version Minor:2
                                                                                              Import Hash:b268dbaa2e6eb6acd16e04d482356598
                                                                                              Instruction
                                                                                              dec eax
                                                                                              mov dword ptr [esp+08h], ebx
                                                                                              dec eax
                                                                                              mov dword ptr [esp+10h], esi
                                                                                              push edi
                                                                                              dec eax
                                                                                              sub esp, 20h
                                                                                              dec ecx
                                                                                              mov edi, eax
                                                                                              mov ebx, edx
                                                                                              dec eax
                                                                                              mov esi, ecx
                                                                                              cmp edx, 01h
                                                                                              jne 00007F057CE1E187h
                                                                                              call 00007F057CE20314h
                                                                                              dec esp
                                                                                              mov eax, edi
                                                                                              mov edx, ebx
                                                                                              dec eax
                                                                                              mov ecx, esi
                                                                                              dec eax
                                                                                              mov ebx, dword ptr [esp+30h]
                                                                                              dec eax
                                                                                              mov esi, dword ptr [esp+38h]
                                                                                              dec eax
                                                                                              add esp, 20h
                                                                                              pop edi
                                                                                              jmp 00007F057CE1E030h
                                                                                              int3
                                                                                              int3
                                                                                              int3
                                                                                              dec eax
                                                                                              mov dword ptr [esp+08h], ecx
                                                                                              dec eax
                                                                                              sub esp, 00000088h
                                                                                              dec eax
                                                                                              lea ecx, dword ptr [00014D05h]
                                                                                              call dword ptr [0000FC7Fh]
                                                                                              dec esp
                                                                                              mov ebx, dword ptr [00014DF0h]
                                                                                              dec esp
                                                                                              mov dword ptr [esp+58h], ebx
                                                                                              inc ebp
                                                                                              xor eax, eax
                                                                                              dec eax
                                                                                              lea edx, dword ptr [esp+60h]
                                                                                              dec eax
                                                                                              mov ecx, dword ptr [esp+58h]
                                                                                              call 00007F057CE2CD0Ah
                                                                                              dec eax
                                                                                              mov dword ptr [esp+50h], eax
                                                                                              dec eax
                                                                                              cmp dword ptr [esp+50h], 00000000h
                                                                                              je 00007F057CE1E1C3h
                                                                                              dec eax
                                                                                              mov dword ptr [esp+38h], 00000000h
                                                                                              dec eax
                                                                                              lea eax, dword ptr [esp+48h]
                                                                                              dec eax
                                                                                              mov dword ptr [esp+30h], eax
                                                                                              dec eax
                                                                                              lea eax, dword ptr [esp+40h]
                                                                                              dec eax
                                                                                              mov dword ptr [esp+28h], eax
                                                                                              dec eax
                                                                                              lea eax, dword ptr [00014CB0h]
                                                                                              dec eax
                                                                                              mov dword ptr [esp+20h], eax
                                                                                              dec esp
                                                                                              mov ecx, dword ptr [esp+50h]
                                                                                              dec esp
                                                                                              mov eax, dword ptr [esp+58h]
                                                                                              dec eax
                                                                                              mov edx, dword ptr [esp+60h]
                                                                                              xor ecx, ecx
                                                                                              call 00007F057CE2CCB8h
                                                                                              jmp 00007F057CE1E1A4h
                                                                                              dec eax
                                                                                              mov eax, dword ptr [eax+eax+00000000h]
                                                                                              Programming Language:
                                                                                              • [ C ] VS2008 build 21022
                                                                                              • [LNK] VS2008 build 21022
                                                                                              • [ASM] VS2008 build 21022
                                                                                              • [IMP] VS2005 build 50727
                                                                                              • [RES] VS2008 build 21022
                                                                                              • [EXP] VS2008 build 21022
                                                                                              • [C++] VS2008 build 21022
                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x55cf00x6f.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x5544c0x3c.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x5a0000x2dffc.rsrc
                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x590000xe1c.pdata
                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x880000x1d8.reloc
                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x520000x288.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                              .text0x10000x504ca0x50600False0.389081940124zlib compressed data5.26882252971IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                              .rdata0x520000x3d5f0x3e00False0.355405745968data5.39218584631IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .data0x560000x20d80x1200False0.180772569444data2.18161586025IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                              .pdata0x590000xe1c0x1000False0.44580078125data4.98556265168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .rsrc0x5a0000x2dffc0x2e000False0.839408542799data7.73448363752IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .reloc0x880000x6f80x800False0.1796875data1.81179169858IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                              NameRVASizeTypeLanguageCountry
                                                                                              RT_RCDATA0x5a0a00x2de00dataEnglishUnited States
                                                                                              RT_MANIFEST0x87ea00x15aASCII text, with CRLF line terminatorsEnglishUnited States
                                                                                              DLLImport
                                                                                              KERNEL32.dllExitProcess, VirtualAlloc, CompareStringW, CompareStringA, GetTimeZoneInformation, GetLocaleInfoW, GetCurrentThreadId, FlsSetValue, GetCommandLineA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, EncodePointer, DecodePointer, TlsAlloc, FlsGetValue, FlsFree, SetLastError, GetLastError, GetCurrentThread, FlsAlloc, HeapFree, Sleep, GetModuleHandleW, GetProcAddress, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapSetInformation, HeapCreate, HeapDestroy, RtlUnwindEx, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LeaveCriticalSection, FatalAppExitA, EnterCriticalSection, HeapAlloc, HeapReAlloc, WriteFile, SetConsoleCtrlHandler, FreeLibrary, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetDateFormatA, GetTimeFormatA, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, HeapSize, SetEnvironmentVariableA
                                                                                              ole32.dllCoTaskMemFree, CoLoadLibrary, CoTaskMemAlloc
                                                                                              NameOrdinalAddress
                                                                                              DllRegisterServer10x180042050
                                                                                              DllUnregisterServer20x180042080
                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                              EnglishUnited States
                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              May 14, 2022 05:01:59.433651924 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:01:59.433717012 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:01:59.433825970 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:01:59.449337959 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:01:59.449402094 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:02:00.008322954 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:02:00.008549929 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:02:00.321414948 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:02:00.321441889 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:02:00.322108984 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:02:00.322221041 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:02:00.325571060 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:02:00.368519068 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:02:01.183480978 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:02:01.183588982 CEST4434976823.239.0.12192.168.2.4
                                                                                              May 14, 2022 05:02:01.183659077 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:02:01.183712006 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:02:01.193293095 CEST49768443192.168.2.423.239.0.12
                                                                                              May 14, 2022 05:02:01.193327904 CEST4434976823.239.0.12192.168.2.4
                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              May 14, 2022 05:04:40.294568062 CEST6148653192.168.2.48.8.8.8
                                                                                              May 14, 2022 05:04:41.874758959 CEST6149753192.168.2.48.8.8.8
                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                              May 14, 2022 05:04:40.294568062 CEST192.168.2.48.8.8.80xe67eStandard query (0)time.windows.comA (IP address)IN (0x0001)
                                                                                              May 14, 2022 05:04:41.874758959 CEST192.168.2.48.8.8.80xf231Standard query (0)time.windows.comA (IP address)IN (0x0001)
                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                              May 14, 2022 05:04:40.320375919 CEST8.8.8.8192.168.2.40xe67eNo error (0)time.windows.comtwc.trafficmanager.netCNAME (Canonical name)IN (0x0001)
                                                                                              May 14, 2022 05:04:41.906085968 CEST8.8.8.8192.168.2.40xf231No error (0)time.windows.comtwc.trafficmanager.netCNAME (Canonical name)IN (0x0001)
                                                                                              • 23.239.0.12
                                                                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                              0192.168.2.44976823.239.0.12443C:\Windows\System32\regsvr32.exe
                                                                                              TimestampkBytes transferredDirectionData
                                                                                              2022-05-14 03:02:00 UTC0OUTGET / HTTP/1.1
                                                                                              Cookie: FugmN=1OaJHNsAdUG/QzkBn8l1MX1OStLIWhSmSDTLsNs0G4JROfReo0NL2i0rsoPV1BdeVsmfza2ZrH2jSD3A7RlZAGL2uK0/svPSt6ZIg32CfsjbTbW0ICsfqahc/t3Lth+1yAyXf3ONRKl+Mfak1Wl03vOtrPlmVbih4SAz2UEfIfN420oFIrdI8a0S8OWrT5hwMpA5AZisltoDDG6nVH953Xl5+37wlyVhH7IA4+D0WH7cUFGg2cHQx2FIuMMy+HugHL7Dluol3+wTAYyysiCssTwZt77IAw==
                                                                                              Host: 23.239.0.12
                                                                                              Connection: Keep-Alive
                                                                                              Cache-Control: no-cache
                                                                                              2022-05-14 03:02:01 UTC0INHTTP/1.1 200 OK
                                                                                              Server: nginx
                                                                                              Date: Sat, 14 May 2022 03:02:01 GMT
                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              2022-05-14 03:02:01 UTC0INData Raw: 33 32 64 0d 0a 0d 7d 65 a0 b0 2a d3 46 b2 c4 e2 1f 12 67 39 f6 5a d3 83 c4 1e 1c 6d a5 63 29 8a 0e 1a f7 83 28 28 56 b8 43 87 7d e5 34 5f 0c d5 04 60 74 38 38 89 86 57 06 7f 0b e0 e3 e9 58 6c f6 f0 af c3 cf bd 56 50 d7 22 36 38 5b 66 04 cf fc a1 e0 5c 07 67 db aa ce 56 be 74 97 8b f8 11 ef d2 e4 22 f2 18 cc bc 2d b3 00 99 18 98 1b 48 03 4d e9 85 17 8f 82 41 46 ec fb 83 6f c3 ea 26 77 17 63 0e de af 17 fc 33 30 3b f0 07 f0 ac 92 d7 68 73 10 94 f6 a9 bc 1a 5a 90 04 f6 04 b7 c3 c2 14 52 76 da 7b 23 d8 4b eb 9e 32 c1 50 53 44 a6 7b 37 48 e1 88 d4 c1 2b 53 e7 d9 62 b2 77 2d 5b 40 d6 85 ab a5 99 62 b3 03 9f 74 e3 70 2c 70 f6 eb c7 f9 29 99 a1 fb 9f 1e 97 78 8c 77 62 a9 a9 ef d0 4d 27 d8 57 9e f2 18 80 0b 32 a2 40 c0 e9 ae 70 98 27 75 9d db ef 6f bc 5b 94 c1 7c
                                                                                              Data Ascii: 32d}e*Fg9Zmc)((VC}4_`t88WXlVP"68[f\gVt"-HMAFo&wc30;hsZRv{#K2PSD{7H+Sbw-[@btp,p)xwbM'W2@p'uo[|


                                                                                              Click to jump to process

                                                                                              Target ID:0
                                                                                              Start time:05:01:20
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\loaddll64.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:loaddll64.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll"
                                                                                              Imagebase:0x7ff7d2b70000
                                                                                              File size:140288 bytes
                                                                                              MD5 hash:4E8A40CAD6CCC047914E3A7830A2D8AA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Target ID:1
                                                                                              Start time:05:01:20
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                                                                                              Imagebase:0x7ff7bb450000
                                                                                              File size:273920 bytes
                                                                                              MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Target ID:2
                                                                                              Start time:05:01:21
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\regsvr32.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:regsvr32.exe /s C:\Users\user\Desktop\1V4gPPcQvB.dll
                                                                                              Imagebase:0x7ff60fb70000
                                                                                              File size:24064 bytes
                                                                                              MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.267523987.0000000002650000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.267727821.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              Reputation:high

                                                                                              Target ID:3
                                                                                              Start time:05:01:21
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\rundll32.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:rundll32.exe "C:\Users\user\Desktop\1V4gPPcQvB.dll",#1
                                                                                              Imagebase:0x7ff74f140000
                                                                                              File size:69632 bytes
                                                                                              MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.263780204.0000028684BB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.262976957.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              Reputation:high

                                                                                              Target ID:4
                                                                                              Start time:05:01:21
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\rundll32.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllRegisterServer
                                                                                              Imagebase:0x7ff74f140000
                                                                                              File size:69632 bytes
                                                                                              MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.262907713.000002CDD9AE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.262542894.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              Reputation:high

                                                                                              Target ID:5
                                                                                              Start time:05:01:25
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\rundll32.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:rundll32.exe C:\Users\user\Desktop\1V4gPPcQvB.dll,DllUnregisterServer
                                                                                              Imagebase:0x7ff74f140000
                                                                                              File size:69632 bytes
                                                                                              MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.271365226.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.270640994.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.271590339.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.288344395.0000017EE83E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.287869129.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.270508750.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              Reputation:high

                                                                                              Target ID:6
                                                                                              Start time:05:01:26
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\regsvr32.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IaRzYtpo\ezkFGDxqYAZSnHs.dll"
                                                                                              Imagebase:0x7ff60fb70000
                                                                                              File size:24064 bytes
                                                                                              MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.773682203.0000000002250000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.773821729.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                              Reputation:high

                                                                                              Target ID:8
                                                                                              Start time:05:01:31
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\WerFault.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\WerFault.exe -u -p 5648 -s 328
                                                                                              Imagebase:0x7ff770e00000
                                                                                              File size:494488 bytes
                                                                                              MD5 hash:2AFFE478D86272288BBEF5A00BBEF6A0
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Target ID:9
                                                                                              Start time:05:01:38
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:10
                                                                                              Start time:05:01:38
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:11
                                                                                              Start time:05:01:39
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:13
                                                                                              Start time:05:01:40
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:14
                                                                                              Start time:05:01:41
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\SgrmBroker.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                              Imagebase:0x7ff6de0f0000
                                                                                              File size:163336 bytes
                                                                                              MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:16
                                                                                              Start time:05:01:42
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:19
                                                                                              Start time:05:01:52
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:20
                                                                                              Start time:05:01:57
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:22
                                                                                              Start time:05:02:33
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:25
                                                                                              Start time:05:02:43
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                              Imagebase:0x7ff678970000
                                                                                              File size:455656 bytes
                                                                                              MD5 hash:A267555174BFA53844371226F482B86B
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:26
                                                                                              Start time:05:02:45
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff647620000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:28
                                                                                              Start time:05:03:00
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:30
                                                                                              Start time:05:03:24
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Target ID:34
                                                                                              Start time:05:04:40
                                                                                              Start date:14/05/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservice -s W32Time
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              No disassembly