Windows Analysis Report
Scan 2022.20.05_0910.xls

Overview

General Information

Sample Name: Scan 2022.20.05_0910.xls
Analysis ID: 632106
MD5: 93ba39759e944e0a660cf1a72919ff59
SHA1: 0d87f3752893a11174df5d1222215014e59d0fd5
SHA256: 72d8274eff2d60af4d452efbfb42abf5ce3ac64ea949772350b3c628c842941a
Tags: xls
Infos:

Detection

Hidden Macro 4.0, Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Document exploit detected (drops PE files)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Document exploit detected (creates forbidden files)
Antivirus detection for URL or domain
Found malicious Excel 4.0 Macro
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Office process drops PE file
Found Excel 4.0 Macro with suspicious formulas
Machine Learning detection for dropped file
Drops PE files to the user root directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Downloads executable code via HTTP
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
PE file contains an invalid checksum
Drops PE files
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Registers a DLL
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Drops PE files to the user directory
Found large amount of non-executed APIs
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Scan 2022.20.05_0910.xls Virustotal: Detection: 44% Perma Link
Source: Scan 2022.20.05_0910.xls ReversingLabs: Detection: 36%
Antivirus detection for URL or domain
Source: https://173.82.82.196:8080/ URL Reputation: Label: malware
Source: http://mcapublicschool.com/Achievements/r4psv/ Avira URL Cloud: Label: malware
Source: https://173.82.82.196/q Avira URL Cloud: Label: malware
Source: http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/ Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/D. Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/bL Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/H. Avira URL Cloud: Label: malware
Source: https://173.82.82.196/ URL Reputation: Label: malware
Source: https://173.82.82.196:8080/e Avira URL Cloud: Label: malware
Source: https://microlent.com/admin/3/ Avira URL Cloud: Label: malware
Source: https://173.82.82.196/vL Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/i Avira URL Cloud: Label: malware
Source: https://173.82.82.196/4. Avira URL Cloud: Label: malware
Source: https://173.82.82.196/nL Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: kuluckaci.com Virustotal: Detection: 7% Perma Link
Source: mcapublicschool.com Virustotal: Detection: 8% Perma Link
Source: moorworld.com Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll Metadefender: Detection: 28% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll Metadefender: Detection: 34% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll ReversingLabs: Detection: 42%
Source: C:\Users\user\uxevr1.ocx ReversingLabs: Detection: 65%
Source: C:\Users\user\uxevr2.ocx Metadefender: Detection: 34% Perma Link
Source: C:\Users\user\uxevr2.ocx ReversingLabs: Detection: 42%
Source: C:\Users\user\uxevr3.ocx Metadefender: Detection: 28% Perma Link
Source: C:\Users\user\uxevr3.ocx ReversingLabs: Detection: 40%
Source: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy) Metadefender: Detection: 34% Perma Link
Source: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy) ReversingLabs: Detection: 42%
Source: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy) Metadefender: Detection: 28% Perma Link
Source: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy) ReversingLabs: Detection: 40%
Source: C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy) ReversingLabs: Detection: 65%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll Joe Sandbox ML: detected
Source: C:\Users\user\uxevr3.ocx Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 103.195.4.8:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 9_2_00000001800248B0

Software Vulnerabilities
barindex
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: Cmk1Nr[1].dll.0.dr Jump to dropped file
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: microlent.com
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 103.195.4.8:443
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 103.195.4.8:443

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.82.82.196 8080 Jump to behavior
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: MULTA-ASN1US MULTA-ASN1US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 173.82.82.196 173.82.82.196
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKCache-Control: no-cache, must-revalidatePragma: no-cacheContent-Type: application/x-msdownloadExpires: Mon, 23 May 2022 07:56:43 GMTLast-Modified: Mon, 23 May 2022 07:56:43 GMTServer: Microsoft-IIS/8.5Set-Cookie: 628b3e3b9c6d7=1653292603; expires=Mon, 23-May-2022 07:57:43 GMT; path=/Content-Disposition: attachment; filename="f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL.dll"Content-Transfer-Encoding: binaryX-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Mon, 23 May 2022 07:56:43 GMTContent-Length: 365056Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /admin/3/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: microlent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /yarisma/cgi-bin/aIuI4Ukdtl730sP1F/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kuluckaci.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Achievements/r4psv/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mcapublicschool.comConnection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49177 -> 173.82.82.196:8080
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1248830029.0000000000301000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme56
Source: regsvr32.exe, 00000009.00000002.1248842369.00000000004C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en~
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196/
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196/4.
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196/nL
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196/q
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196/vL
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/D.
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/H.
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/bL
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/e
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/i
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll Jump to behavior
Source: unknown DNS traffic detected: queries for: microlent.com
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180006B24 InternetReadFile, 4_2_0000000180006B24
Source: global traffic HTTP traffic detected: GET /admin/3/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: microlent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /yarisma/cgi-bin/aIuI4Ukdtl730sP1F/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kuluckaci.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Achievements/r4psv/ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mcapublicschool.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 103.195.4.8:443 -> 192.168.2.22:49173 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 3.2.regsvr32.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.regsvr32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.regsvr32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1248680431.0000000000160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.930405356.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.919412326.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1249191933.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1248874495.0000000000510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.914158918.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.930201138.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1248687990.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1249180337.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing and click Enable Content. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
Source: Screenshot number: 4 Screenshot OCR: Enable Content. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
Source: Document image extraction number: 0 Screenshot OCR: Enable Editing and click Enable Content.
Source: Document image extraction number: 0 Screenshot OCR: Enable Content.
Source: Document image extraction number: 1 Screenshot OCR: Enable Editing and click Enable Content.
Source: Document image extraction number: 1 Screenshot OCR: Enable Content.
Found malicious Excel 4.0 Macro
Source: Scan 2022.20.05_0910.xls Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: Scan 2022.20.05_0910.xls Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr1.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr3.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr2.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll Jump to dropped file
Found Excel 4.0 Macro with suspicious formulas
Source: Scan 2022.20.05_0910.xls Initial sample: EXEC
Source: Scan 2022.20.05_0910.xls Initial sample: EXEC
Creates files inside the system directory
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\system32\PlMfP\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D212B0 3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D25E01 3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D25CAD 3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D26850 3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D2443C 3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D253FB 3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D24A70 3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_001D0000 3_2_001D0000
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180005C74 3_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002ACE8 3_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180020118 3_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000359C 3_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000E99C 3_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180019628 3_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180025A4C 3_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002B7B2 3_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180009408 3_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180023C14 3_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180006414 3_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002582C 3_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000B834 3_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000403C 3_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180021444 3_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180012044 3_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180016054 3_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001705C 3_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180001870 3_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001F878 3_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180014484 3_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015494 3_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000BC98 3_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180008C9C 3_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800078A4 3_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001F0A8 3_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001E4AC 3_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800048B0 3_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001ACB4 3_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800090B4 3_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800270C0 3_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800024C0 3_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800280C8 3_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800050D4 3_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800234D8 3_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800150F0 3_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180012500 3_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180024104 3_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001A10C 3_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180028D10 3_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001A524 3_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180002D28 3_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000E130 3_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180029134 3_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180008134 3_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180022140 3_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180006954 3_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000F554 3_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002B564 3_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180012168 3_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180013568 3_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180024570 3_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180019178 3_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180025180 3_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180001980 3_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180021588 3_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001A988 3_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180018190 3_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180013994 3_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180028998 3_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800061A0 3_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800135A6 3_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180016DA8 3_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800059AC 3_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800135B4 3_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001C1B8 3_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800025B8 3_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800085BC 3_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800015C0 3_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800295C8 3_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800229CC 3_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000E5D4 3_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002A5D8 3_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800261E0 3_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800079EC 3_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180023624 3_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180018628 3_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180017E2C 3_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180017638 3_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180004E3C 3_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180020E40 3_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015A64 3_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015264 3_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000A26C 3_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180007678 3_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001667C 3_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180012680 3_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180001E88 3_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000968C 3_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180022290 3_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180026A90 3_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000529C 3_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180020AA0 3_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180022AAC 3_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180007EB4 3_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800162BC 3_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800252C0 3_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001AEC8 3_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001F6DC 3_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800026DC 3_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180002ADC 3_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001E2F4 3_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180016AF4 3_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000DEF4 3_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001DEFC 3_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180006308 3_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001370C 3_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180004B18 3_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015F24 3_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180006B24 3_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000F328 3_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180021738 3_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002AF38 3_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180028348 3_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000DB4C 3_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180014F50 3_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000B350 3_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000A758 3_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018002975C 3_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180024370 3_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180008370 3_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015774 3_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180012378 3_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180026B98 3_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001CF9C 3_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001EBA0 3_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018001B3A4 3_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000D7AC 3_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800053B0 3_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180015BB8 3_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800207BC 3_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000FFC0 3_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_00000001800173DC 3_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180018BDC 3_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00130000 4_2_00130000
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000C819 4_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180019628 4_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180025A4C 4_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001705C 4_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180012864 4_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180005C74 4_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800248B0 4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800090B4 4_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800252C0 4_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800024C0 4_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180024104 4_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180006B24 4_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180006F2C 4_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000A758 4_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180024570 4_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000E99C 4_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001B3A4 4_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800079EC 4_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180009408 4_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180023C14 4_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180006414 4_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180023624 4_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180018628 4_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018002582C 4_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180017E2C 4_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000B834 4_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180017638 4_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000403C 4_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180004E3C 4_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180020E40 4_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180021444 4_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180012044 4_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180016054 4_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180015A64 4_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180015264 4_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000A26C 4_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180001870 4_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001F878 4_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180007678 4_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001667C 4_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180012680 4_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180014484 4_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180001E88 4_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000968C 4_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180022290 4_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180026A90 4_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180015494 4_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000BC98 4_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000529C 4_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180008C9C 4_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180020AA0 4_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800078A4 4_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001F0A8 4_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180022AAC 4_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001E4AC 4_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800048B0 4_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001ACB4 4_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180007EB4 4_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800162BC 4_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800270C0 4_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800280C8 4_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001AEC8 4_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800050D4 4_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800234D8 4_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001F6DC 4_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800026DC 4_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180002ADC 4_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018002ACE8 4_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800150F0 4_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001E2F4 4_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180016AF4 4_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000DEF4 4_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001DEFC 4_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180012500 4_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180006308 4_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001370C 4_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001A10C 4_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180028D10 4_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180020118 4_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180004B18 4_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001A524 4_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180015F24 4_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000F328 4_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180002D28 4_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000E130 4_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180029134 4_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180008134 4_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180021738 4_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018002AF38 4_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180022140 4_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180028348 4_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000DB4C 4_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180014F50 4_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000B350 4_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180006954 4_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000F554 4_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018002975C 4_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018002B564 4_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180012168 4_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180013568 4_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180024370 4_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180008370 4_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180015774 4_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180012378 4_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180019178 4_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180025180 4_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180001980 4_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180021588 4_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001A988 4_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180018190 4_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180013994 4_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180026B98 4_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180028998 4_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001CF9C 4_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000359C 4_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001EBA0 4_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800061A0 4_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800135A6 4_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180016DA8 4_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800059AC 4_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000D7AC 4_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800053B0 4_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800135B4 4_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018001C1B8 4_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180015BB8 4_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800025B8 4_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800207BC 4_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800085BC 4_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800015C0 4_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000FFC0 4_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800295C8 4_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800229CC 4_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018000E5D4 4_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_000000018002A5D8 4_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800173DC 4_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180018BDC 4_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800261E0 4_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F12B0 5_2_000007FEF74F12B0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F443C 5_2_000007FEF74F443C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F53FB 5_2_000007FEF74F53FB
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F4A70 5_2_000007FEF74F4A70
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F5E01 5_2_000007FEF74F5E01
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F5CAD 5_2_000007FEF74F5CAD
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F6850 5_2_000007FEF74F6850
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00130000 5_2_00130000
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180005C74 5_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002ACE8 5_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180020118 5_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000359C 5_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000E99C 5_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180019628 5_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180025A4C 5_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002B7B2 5_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180009408 5_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180023C14 5_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180006414 5_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002582C 5_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000B834 5_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000403C 5_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180021444 5_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180012044 5_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180016054 5_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001705C 5_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180001870 5_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001F878 5_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180014484 5_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015494 5_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000BC98 5_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180008C9C 5_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800078A4 5_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001F0A8 5_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001E4AC 5_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800048B0 5_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001ACB4 5_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800090B4 5_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800270C0 5_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800024C0 5_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800280C8 5_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800050D4 5_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800234D8 5_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800150F0 5_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180012500 5_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180024104 5_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001A10C 5_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180028D10 5_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001A524 5_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180002D28 5_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000E130 5_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180029134 5_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180008134 5_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180022140 5_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180006954 5_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000F554 5_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002B564 5_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180012168 5_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180013568 5_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180024570 5_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180019178 5_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180025180 5_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180001980 5_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180021588 5_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001A988 5_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180018190 5_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180013994 5_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180028998 5_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800061A0 5_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800135A6 5_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180016DA8 5_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800059AC 5_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800135B4 5_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001C1B8 5_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800025B8 5_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800085BC 5_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800015C0 5_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800295C8 5_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800229CC 5_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000E5D4 5_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002A5D8 5_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800261E0 5_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800079EC 5_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180023624 5_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180018628 5_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180017E2C 5_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180017638 5_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180004E3C 5_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180020E40 5_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015A64 5_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015264 5_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000A26C 5_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180007678 5_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001667C 5_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180012680 5_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180001E88 5_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000968C 5_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180022290 5_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180026A90 5_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000529C 5_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180020AA0 5_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180022AAC 5_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180007EB4 5_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800162BC 5_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800252C0 5_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001AEC8 5_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001F6DC 5_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800026DC 5_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180002ADC 5_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001E2F4 5_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180016AF4 5_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000DEF4 5_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001DEFC 5_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180006308 5_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001370C 5_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180004B18 5_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015F24 5_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180006B24 5_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000F328 5_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180021738 5_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002AF38 5_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180028348 5_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000DB4C 5_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180014F50 5_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000B350 5_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000A758 5_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018002975C 5_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180024370 5_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180008370 5_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015774 5_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180012378 5_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180026B98 5_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001CF9C 5_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001EBA0 5_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018001B3A4 5_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000D7AC 5_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800053B0 5_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180015BB8 5_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800207BC 5_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000FFC0 5_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_00000001800173DC 5_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180018BDC 5_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_001B0000 7_2_001B0000
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000C819 7_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180019628 7_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180025A4C 7_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001705C 7_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012864 7_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180005C74 7_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800248B0 7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800252C0 7_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800024C0 7_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006B24 7_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006F2C 7_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000A758 7_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180024570 7_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000E99C 7_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001B3A4 7_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800079EC 7_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180009408 7_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023C14 7_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006414 7_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180023624 7_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180018628 7_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002582C 7_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180017E2C 7_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000B834 7_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180017638 7_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000403C 7_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180004E3C 7_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180020E40 7_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180021444 7_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012044 7_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180016054 7_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015A64 7_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015264 7_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000A26C 7_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001870 7_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001F878 7_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180007678 7_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001667C 7_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012680 7_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180014484 7_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180001E88 7_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000968C 7_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180022290 7_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180026A90 7_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180015494 7_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000BC98 7_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000529C 7_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180008C9C 7_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180020AA0 7_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800078A4 7_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001F0A8 7_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180022AAC 7_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E4AC 7_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800048B0 7_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001ACB4 7_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180007EB4 7_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800090B4 7_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800162BC 7_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800270C0 7_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800280C8 7_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001AEC8 7_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800050D4 7_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800234D8 7_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001F6DC 7_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800026DC 7_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180002ADC 7_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018002ACE8 7_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800150F0 7_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001E2F4 7_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180016AF4 7_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018000DEF4 7_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001DEFC 7_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180012500 7_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180024104 7_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180006308 7_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001370C 7_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_000000018001A10C 7_2_000000018001A10C
Found potential string decryption / allocating functions
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF74F7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF70C7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF70CBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF74FBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF9D2BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF74FB3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 000007FEF70CB3B0 appears 148 times
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: 5F20.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found a hidden Excel 4.0 Macro sheet
Source: Scan 2022.20.05_0910.xls Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: Scan 2022.20.05_0910.xls Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: Scan 2022.20.05_0910.xls Virustotal: Detection: 44%
Source: Scan 2022.20.05_0910.xls ReversingLabs: Detection: 36%
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr1.ocx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR56A7.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@16/17@4/5
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Scan 2022.20.05_0910.xls OLE indicator, Workbook stream: true
Source: Scan 2022.20.05_0910.xls.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180006F2C CloseHandle,Process32FirstW,CreateToolhelp32Snapshot,Process32NextW, 4_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Scan 2022.20.05_0910.xls Initial sample: OLE indicators vbamacros = False
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000C892 push ebp; retf 3_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000D095 push B3B8007Eh; iretd 3_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000D0F3 push ebp; iretd 3_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0000000180013551 push ebx; retf 3_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000D15D push ebx; retn 0068h 3_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000CDA8 push ebp; iretd 3_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000000018000CE36 push 458B0086h; iretd 3_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_0000000180013551 push ebx; retf 4_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000C892 push ebp; retf 5_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000D095 push B3B8007Eh; iretd 5_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000D0F3 push ebp; iretd 5_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_0000000180013551 push ebx; retf 5_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000D15D push ebx; retn 0068h 5_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000CDA8 push ebp; iretd 5_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000000018000CE36 push 458B0086h; iretd 5_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_0000000180013551 push ebx; retf 7_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000C892 push ebp; retf 8_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000D095 push B3B8007Eh; iretd 8_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000D0F3 push ebp; iretd 8_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_0000000180013551 push ebx; retf 8_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000D15D push ebx; retn 0068h 8_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000CDA8 push ebp; iretd 8_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000000018000CE36 push 458B0086h; iretd 8_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180013551 push ebx; retf 9_2_0000000180013559
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 3_2_000007FEF9D30CC0
PE file contains an invalid checksum
Source: uxevr1.ocx.0.dr Static PE information: real checksum: 0x654f5 should be: 0x67d8e
Source: uxevr3.ocx.0.dr Static PE information: real checksum: 0x654f5 should be: 0x6165e
Source: uxevr2.ocx.0.dr Static PE information: real checksum: 0x654f5 should be: 0x61d00
Source: f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll.0.dr Static PE information: real checksum: 0x654f5 should be: 0x6165e
Source: Cmk1Nr[1].dll.0.dr Static PE information: real checksum: 0x654f5 should be: 0x67d8e
Source: xqJfpnc0wEmcroPdpB[1].dll.0.dr Static PE information: real checksum: 0x654f5 should be: 0x61d00
Registers a DLL
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll"
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr1.ocx Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy) Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr3.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr2.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy) Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy) Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr1.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr3.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr2.ocx Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr1.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr3.ocx Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\uxevr2.ocx Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\PlMfP\OpoHHoBHS.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\regsvr32.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\regsvr32.exe TID: 2520 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2728 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2944 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 3044 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2536 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1988 Thread sleep time: -60000s >= -30000s Jump to behavior
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\System32\regsvr32.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\System32\regsvr32.exe API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe API coverage: 7.3 %
Source: C:\Windows\System32\regsvr32.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe Code function: 7_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 9_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_000007FEF9D23280
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error, 3_2_000007FEF9D30215
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 3_2_000007FEF9D30CC0
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74F3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_000007FEF74F3280
Source: C:\Windows\System32\regsvr32.exe Code function: 5_2_000007FEF74FBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_000007FEF74FBE50
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF70CBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_000007FEF70CBE50
Source: C:\Windows\System32\regsvr32.exe Code function: 8_2_000007FEF70C3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_000007FEF70C3280

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.82.82.196 8080 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 3_2_000007FEF9D28900
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation, 3_2_000007FEF9D28860

Stealing of Sensitive Information
barindex
Yara detected Emotet
Source: Yara match File source: 3.2.regsvr32.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.regsvr32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.regsvr32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.regsvr32.exe.510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1248680431.0000000000160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.930405356.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.919412326.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1249191933.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1248874495.0000000000510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.914158918.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.930201138.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1248687990.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1249180337.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 632106 Sample: Scan 2022.20.05_0910.xls Startdate: 23/05/2022 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for domain / URL 2->54 56 Antivirus detection for URL or domain 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 10 other signatures 2->60 7 EXCEL.EXE 53 27 2->7         started        12 svchost.exe 2->12         started        process3 dnsIp4 46 kuluckaci.com 185.86.13.242, 49174, 80 IDEALHOSTINGTR Turkey 7->46 48 microlent.com 103.195.4.8, 443, 49173 KAMATERAINC-AS-APKamateraIncHK Hong Kong 7->48 50 2 other IPs or domains 7->50 32 C:\Users\user\uxevr3.ocx, PE32+ 7->32 dropped 34 C:\Users\user\uxevr2.ocx, PE32+ 7->34 dropped 36 C:\Users\user\uxevr1.ocx, PE32+ 7->36 dropped 38 4 other malicious files 7->38 dropped 64 Document exploit detected (creates forbidden files) 7->64 66 Document exploit detected (UrlDownloadToFile) 7->66 14 regsvr32.exe 2 7->14         started        18 regsvr32.exe 2 7->18         started        20 regsvr32.exe 2 7->20         started        22 regsvr32.exe 7->22         started        file5 signatures6 process7 file8 40 C:\Windows\...\HrQqTfHWMtY.dll (copy), PE32+ 14->40 dropped 68 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->68 24 regsvr32.exe 14->24         started        42 C:\Windows\System32\...\OpoHHoBHS.dll (copy), PE32+ 18->42 dropped 27 regsvr32.exe 2 18->27         started        44 C:\Windows\...\JuebGslFXTeyRNG.dll (copy), PE32+ 20->44 dropped 30 regsvr32.exe 20->30         started        signatures9 process10 dnsIp11 62 System process connects to network (likely due to code injection or exploit) 24->62 52 173.82.82.196, 49177, 49179, 49180 MULTA-ASN1US United States 27->52 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.133.214.149
 mcapublicschool.com India
133643 EWEBGURU-ASEWEBGURUIN false
173.82.82.196
 unknown United States
35916 MULTA-ASN1US true
185.86.13.242
 kuluckaci.com Turkey
29262 IDEALHOSTINGTR true
103.195.4.8
 microlent.com Hong Kong
64022 KAMATERAINC-AS-APKamateraIncHK false
211.149.139.157
 moorworld.com China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false

Contacted Domains

Name IP Active
kuluckaci.com 185.86.13.242 true
mcapublicschool.com 103.133.214.149 true
moorworld.com 211.149.139.157 true
microlent.com 103.195.4.8 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://mcapublicschool.com/Achievements/r4psv/ true
  • Avira URL Cloud: malware
 unknown
http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/ true
  • Avira URL Cloud: malware
 unknown
https://microlent.com/admin/3/ true
  • Avira URL Cloud: malware
 unknown